Skip to content

Commit f3d3ab0

Browse files
philipnorton42philipnorton42
committed
Reworked the authenticate system so that a function called checkAuthenticationDetails() is used to check the user details, the result of which is then used to determine if the user should log in or not. Also re-formatted the code in this file.
1 parent 5b1d3a3 commit f3d3ab0

File tree

1 file changed

+114
-79
lines changed

1 file changed

+114
-79
lines changed

‎web/login.php

Lines changed: 114 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,14 @@
44
session_start();
55

66
if (isset($_SESSION['user_id'])) {
7-
// If the 'user_id' session variable is present then the user is already
8-
// authenticated. In this case we redirect them to the homepage.
9-
header("Location: index.php");
10-
exit();
7+
// If the 'user_id' session variable is present then the user is already
8+
// authenticated. In this case we redirect them to the homepage.
9+
header("Location: index.php");
10+
exit();
1111
}
1212

1313
/**
14-
* Authenticate the user credentials against the values in the database.
14+
* Check the user credentials against the values in the database.
1515
*
1616
* @param string $username
1717
* The provided username.
@@ -20,95 +20,130 @@
2020
* @param mysqli $mysqli
2121
* The MySQL connection.
2222
*
23-
* @return string
24-
* If an error was encountered then a string detailing the error is returned.
25-
* Else we authenticate the user and redirect to the homepage.
23+
* @return bool
24+
* True if the user account was authenticated.
2625
*/
27-
function authenticate(string $username, string $password, mysqli $mysqli):string {
28-
// Make sure the username and password fields have something in them.
29-
if (empty($username) && empty($password)) {
30-
return 'Please enter a username and password.';
31-
}
32-
33-
// Search the database for the user based on their username.
34-
$stmt = $mysqli->prepare("SELECT id, name, password FROM users WHERE username = ?;");
35-
$stmt->bind_param("s", $username);
36-
$stmt->execute();
37-
$result = $stmt->get_result()->fetch_all(MYSQLI_ASSOC) ?: null;
38-
39-
if ($result === null) {
40-
return 'Username or password is incorrect.';
41-
}
26+
function checkAuthenticationDetails(string $username, string $password, mysqli $mysqli): string
27+
{
28+
// Make sure the username and password fields have something in them.
29+
if ($username === '' && $password === '') {
30+
// As the username and password fields are empty we return false to show
31+
// that the authentication attempt was not successful.
32+
return false;
33+
}
34+
35+
// Search the database for the user based on their username.
36+
$stmt = $mysqli->prepare("SELECT password FROM users WHERE username = ?;");
37+
$stmt->bind_param("s", $username);
38+
$stmt->execute();
39+
$result = $stmt->get_result()->fetch_assoc();
40+
41+
if ($result === null) {
42+
// If the result here is null, then the user doesn't exist. We return false
43+
// to show that the authentication attempt was not successful.
44+
return false;
45+
}
46+
47+
// Validate the supplied password against the hashed password in the database.
48+
if (password_verify($password, $result['password']) === false) {
49+
// The user account exists but the supplied password doesn't verify
50+
// correctly, meaning that it is not the same. Return false to show that
51+
// the authentication attempt was not successful.
52+
return false;
53+
}
54+
55+
// Finally, return true so that we can react to a successful authentication.
56+
return true;
57+
}
4258

43-
$result = reset($result);
59+
// Initialise the error variable.
60+
$error = '';
4461

45-
// Validate the supplied password against the hashed password in the database.
46-
if (password_verify($password, $result['password']) === false) {
47-
return 'Username or password is incorrect.';
48-
}
62+
if (isset($_POST['username']) && isset($_POST['password'])) {
63+
// User credentials have been entered, trim them to prevent common
64+
// whitespace mistakes.
65+
$username = trim($_POST['username']);
66+
$password = trim($_POST['password']);
67+
68+
// Include the database connection.
69+
require_once '../database_connection.php';
70+
71+
// Attempt to authenticate the user.
72+
$authenticationSuccessful = checkAuthenticationDetails($username, $password, $mysqli);
73+
74+
if ($authenticationSuccessful) {
75+
// The user authenticated correctly, so we load their user details from the
76+
// database and store them in the $_SESSION variable. The presence of the
77+
// username in the session superglobal shows that they logged in correctly.
78+
$stmt = $mysqli->prepare("SELECT id, name FROM users WHERE username = ?;");
79+
$stmt->bind_param("s", $username);
80+
$stmt->execute();
81+
$result = $stmt->get_result()->fetch_assoc();
4982

50-
// The password validates correctly, so add their username to
51-
// the $_SESSION variable, which will log the user in.
5283
$_SESSION['username'] = $username;
53-
$_SESSION['name'] = htmlspecialchars($result['name']);
84+
$_SESSION['name'] = $result['name'];
5485
$_SESSION['user_id'] = $result['id'];
5586

5687
// Redirect the user back to the homepage.
5788
header("Location: index.php");
5889
exit();
59-
}
60-
61-
if (isset($_POST['username']) && isset($_POST['password'])) {
62-
// User credentials have been entered, trim them to prevent common
63-
// whitespace mistakes.
64-
$username = trim($_POST['username']);
65-
$password = trim($_POST['password']);
66-
67-
// Include the database connection.
68-
require_once '../database_connection.php';
69-
70-
// Attempt to authenticate the user.
71-
$error = authenticate($username, $password, $mysqli);
90+
} else {
91+
// Authentication was not successful, update the error variable so that we can print a message to the user.
92+
$error = 'Username or password is incorrect.';
93+
}
7294
}
7395

7496
?>
7597
<!DOCTYPE html>
7698
<html>
77-
<head>
78-
<title>Login</title>
79-
<link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-4bw+/aepP/YC94hEpVNVgiZdgIC5+VKNBQNGCHeKRQN+PtmoHDEXuppvnDJzQIu9" crossorigin="anonymous">
80-
</head>
81-
<body>
82-
<div class="container">
83-
<header class="d-flex flex-wrap py-3 mb-4 border-bottom">
84-
<a href="/" class="d-flex align-items-center mb-3 mb-md-0 me-md-auto text-dark text-decoration-none">
85-
<span class="fs-4">Authentication Example</span>
86-
</a>
87-
</header>
88-
</div>
89-
90-
<div class="container mt-5">
91-
<div class="row d-flex justify-content-center">
92-
<div class="col-md-6">
93-
<form action="login.php" method="post">
94-
<h2>Login</h2>
95-
<?php if (empty($error) === false) { ?>
96-
<p class="alert alert-danger"><?php echo $error; ?></p>
97-
<?php } ?>
98-
99-
<div class="form-outline mb-4">
100-
<label class="form-label" for="form-username">Username</label>
101-
<input type="text" name="username" placeholder="Username" id="form-username" autocomplete="autocomplete" class="form-control" value="<?php echo $_POST['username'] ?? '';?>">
102-
</div>
103-
<div class="form-outline mb-4">
104-
<label class="form-label" for="form-password">Password</label>
105-
<input type="password" name="password" placeholder="Password" id="form-password" autocomplete="autocomplete" class="form-control">
106-
</div>
107-
108-
<button type="submit" class="btn btn-primary btn-block mb-4">Login</button>
109-
</form>
99+
<head>
100+
<title>Login</title>
101+
<link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css"
102+
rel="stylesheet"
103+
integrity="sha384-4bw+/aepP/YC94hEpVNVgiZdgIC5+VKNBQNGCHeKRQN+PtmoHDEXuppvnDJzQIu9"
104+
crossorigin="anonymous">
105+
</head>
106+
<body>
107+
<div class="container">
108+
<header class="d-flex flex-wrap py-3 mb-4 border-bottom">
109+
<a href="/"
110+
class="d-flex align-items-center mb-3 mb-md-0 me-md-auto text-dark text-decoration-none">
111+
<span class="fs-4">Authentication Example</span>
112+
</a>
113+
</header>
114+
</div>
115+
116+
<div class="container mt-5">
117+
<div class="row d-flex justify-content-center">
118+
<div class="col-md-6">
119+
<form action="login.php" method="post">
120+
<h2>Login</h2>
121+
<?php if ($error !== '') { ?>
122+
<p class="alert alert-danger"><?php echo $error; ?></p>
123+
<?php } ?>
124+
125+
<div class="form-outline mb-4">
126+
<label class="form-label"
127+
for="form-username">Username</label>
128+
<input type="text" name="username" placeholder="Username"
129+
id="form-username" autocomplete="autocomplete"
130+
class="form-control"
131+
value="<?php echo $_POST['username'] ?? ''; ?>">
110132
</div>
111-
</div>
133+
<div class="form-outline mb-4">
134+
<label class="form-label"
135+
for="form-password">Password</label>
136+
<input type="password" name="password"
137+
placeholder="Password" id="form-password"
138+
autocomplete="autocomplete" class="form-control">
139+
</div>
140+
141+
<button type="submit" class="btn btn-primary btn-block mb-4">
142+
Login
143+
</button>
144+
</form>
112145
</div>
113-
</body>
146+
</div>
147+
</div>
148+
</body>
114149
</html>

0 commit comments

Comments
 (0)