PHP · MySQL · Apache · Linux
Login & Registration System
A small, honest auth flow on the classic LAMP stack: sign up, log in, see a private dashboard, log out. Rebuilt with bcrypt passwords, prepared SQL and CSRF tokens.
- PHP 8
- PDO
- MySQL
- HTML
- CSS
- JavaScript
100%
SQL queries prepared
60ch
bcrypt hash length
32B
random CSRF token
4pg
PHP pages, no framework
Live demo
Try it right here
Create an account, log in and open the dashboard. The forms follow the same rules as the PHP version.
Already have an account?
New here?
Session active
Hi,
- Member since
- Stored hash
- Session
- sessionStorage (demo)
// Why a browser demo?
GitHub Pages only serves static files, so it cannot run PHP or MySQL.
This demo copies the app's rules in JavaScript. Accounts stay in your browser
(localStorage), and passwords are salted + SHA-256 hashed before they are saved.
The real app in app/ uses PHP, PDO and password_hash() (bcrypt).
Run it locally with XAMPP to see the server version.
Features
Small app, real security basics
-
01 / passwords
bcrypt hashing
password_hash()andpassword_verify()replace the oldmd5(). Old hashes get upgraded on login. -
02 / database
Prepared statements
Every query goes through PDO with placeholders, so user input can never change the SQL.
-
03 / forms
CSRF tokens
Each form carries a random token. Log out is a POST request, not a link anyone could trigger.
-
04 / output
XSS-safe output
Everything a user typed is escaped with
htmlspecialchars()before it reaches the page. -
05 / sessions
Hardened sessions
HttpOnly, SameSite cookies and a fresh session id after login stop session fixation.
-
06 / design
Light, dark, mobile
Theme follows your system and remembers your choice. Works at 390 px and respects reduced motion.
How it works
From form to session
- ValidateUsername, email and password are checked on the server.
- HashThe password becomes a one-way bcrypt hash.
- StoreA prepared
INSERTsaves the user in MySQL. - SessionLogin verifies the hash and starts a new session.