PHP Login & signup website with basic Security | MYSQL, CSRF tokens, prepared statements & more

[@Cupid_Codes]

I love your videos! As a self-taught software developer your videos have helped me so much. Keep the videos coming!

[@QuickProgramming]

thanks :) i really appreciate you taking the time to leave some feedback :))

[@Gonga94tz]

Hongera Sana nakupata kutoka morogoro Tanzania

[@pha_mous]

The best tutorial I have ever encounter on KZbin… pls I wish to be your student, am newbie in programming

[@QuickProgramming]

Thanks for the feedback! good luck with PHP. check my playlists for topics you may like and watch the OOP series as well to learn advanced topics once you're good enough with the basics

[@navjotsinghDhanoa]

Learning php has become fun cos of your tutorials. Thanks a lot

[@jNRoss123]

You make it so easy to follow along and understand. I really appreciate your videos! They have helped me so much!

[@QuickProgramming]

You are so welcome!

[@jsmithtraveller]

It's been a long time since I programmed anything and this tutorial is brilliant, reminded me of those little page / site code snippets to enhance security. I'll be learning from the other videos on your channel also. Cheers!

[@QuickProgramming]

glad to hear it thanks :))

[@ca7986]

Loving your channel. Specially about this security. Great work!

[@QuickProgramming]

thank you so much for the wonderful feedback. i really appreciate it :)

[@ca7986]

@@QuickProgramming and thank you so much for this video ❤️

[@QuickProgramming]

@@ca7986 you're most welcome

[@robertshirck1321]

Thank you for your time and effort! For a 2-hour video, it took me much, much longer to imitate and get to work correctly. But I learned a lot...especially fixing my mistakes. Really enjoyed your presentation style. Made my day(s)!

[@QuickProgramming]

Glad it helped! the key to becoming a good programmer is knowing how to fix errors and even having fun while doing it. this is the ultimate secret. so am happy you've learnt some new skills :)

[@krillinsworld9439]

I was expecting to see password_hash here. No one I seen has ever used this function with ANY tutorial I have watched in the past 5+ years. It is so simple to use than the unsafe MD5. You did not use any password hashing here at all. This is a VERY simple process to include yet no one does.. But I loved the demonstration of the tokens. That was very cool and easy to understand. I need to get back to my PHP Security Mastery classes. In case anyone was wondering: You have the $password = password_hash($password, DEFAULT_PASSWORD) { //reset of inserting user data } -- Then in your login script you run a statement to fetch the user information based on $email or $username, with your array you do password_verify($password, $data['0']['password']) { //rest of your login code if true }. Of in the case with this example $data['password'] because the $data = $data[0]; first dataset in the array is already set for you.

[@QuickProgramming]

i use password_hash in ALL my tutorials except this one

[@krillinsworld9439]

Thank you for your quick reply. That is good to know, I have been implementing this since I learned how to include it in my code. I mainly follow @Dani_Krossing for learning to code, but I have swung into more advanced coding which is more than I can find here. Thank you!@@QuickProgramming

[@A_ALI24]

Thank you very much. I have learned a lot from your videos. It's good that you show different programming methods during the course, and indicate which one is the best. Keep up. All the best.

[@QuickProgramming]

Thanks for taking the time to leave some feedback and You are most welcome!

[@faridisayev1570]

Great tutorials! My favorite channel!

[@QuickProgramming]

Thank you!😀😊

[@secretmezzanine212]

These videos are awesome ! You are fun to listen to and explain things well. I really enjoy watching your videos - thanks for putting time into them.

[@davidsulaberidze5978]

Thank you very much

[@QuickProgramming]

you're very welcome :)

[@laovoyage]

Thank you for sharing

[@QuickProgramming]

Thanks for watching!

[@renegade1807]

Great video, please keep up the good work! Security is not covered enough in this day and age. Sub'd.

[@QuickProgramming]

thanks for taking the time to leave some feedback and for the sub too :D i appreciate it

[@renegade1807]

@@QuickProgramming You are very welcome. All the best.

[@abdomahmoud8769]

At 1:36:03, the null coalescing operator can be used to echo an empty string if the post variables aren't set yet. Example: value=""

[@thepatlagoon]

Are you implementing this within the login/signup system from previous video?

[@QuickProgramming]

no, this is a separate video just aimed at highlighting security issues in login systems

[@thepatlagoon]

@@QuickProgramming can you assist me in doing password complexity check for previous video please.

[@thepatlagoon]

@@QuickProgramming can you?

[@laoadventuretour5012]

Thanks for sharing the good video

[@salluc1712]

very good quality topics and video thank you man thats amazing;

[@QuickProgramming]

You're most welcome and thank you for your feedback.😊😊

[@laovoyage]

Thanks a lot !

[@QuickProgramming]

You are welcome!

[@smartambroseug69]

very instrumental

[@QuickProgramming]

thanks for the feedback :)

[@DoofGore]

Great work sir, Thank you so much.

[@QuickProgramming]

You're most welcome!

[@ca7986]

Amazing video! Cant stop coming back on this video. Please make more on security of web application implementation. ❤️

[@QuickProgramming]

thanks, i'll make some more. i have one planned that will also deal with security in an object oriented way

[@ca7986]

@@QuickProgramming ❤️ you are awesome mate!

[@nihongo_]

good video

[@QuickProgramming]

Thanks

[@LukasKL73]

thank you for the video, it helps me to understand the security principles on web pages

[@QuickProgramming]

thank you for the feedback. you're most welcome :)

[@musabyemungujanvier7259]

Very good

[@QuickProgramming]

Thanks

[@quasarmaximus5662]

Fantastic! Thank you! :^)

[@QuickProgramming]

you're most welcome :)

[@pythonlife]

Thank you for all the lessons and courses, but the most important thing is the background music. Do not let me focus. Please do not use any background music. Thank you.

[@ryantheghost2185]

Tysm! Can you make a video on css form styling? im not good at it, I only work with php oop and im very bad at this!

[@QuickProgramming]

dont worry about it, i'll make one but also i found a tool that lets you drag and drop a whole form so you can create html in a short time. am working on a tutorial

[@error7715]

Escape using htmlspecialchars in the values part.

[@Hohn-jq3gq]

In minute 25:13 you said "also"! This word was a german word...are you from Germany? xD Your tutorials are great, thx for this^^

[@QuickProgramming]

lol actually no am not from Germany. am sure it was just a coincidence :) thanks for the awesome feedback!

[@thomashapp362]

Hi, well done! I've learned a lot! Thank you very much! I only have one issue: when i log out on my index.php I am redirected to my login.php (via logout.php) - that's fine. (1:45 in the video.) BUT if i hit the back-button then, I land on my index.php with my user-name. Did I mistype something? (Mac OS & Safari)

[@QuickProgramming]

thanks, am glad to hear that! as for your error, does it still show your username when you fresh the page? if so then your session is still active. it means the logout page didnt do its job, it simply redirected you. so comment out the redirect part in the logout. then logout and see if you get some errors or simply a blank page

[@thomashapp362]

@@QuickProgramming Ops ... the logout.php works fine (tested with var_dump) - and when I refresh the index.php I am redirected to the login. So everything seems to be good. Just an cosmetic issue I guess. Thanx for your assistance! BTW: I build my first website - may I engage you to check that pig-style thing then?

[@QuickProgramming]

sure

[@thomashapp362]

@@QuickProgramming Hi, are you still interested in checking my site (in fact my whites site) ? If so, how can we get in contact?

[@BlokeBritish]

Good 1 Man - for a beginner like me, this is it !! I wonder if u cd follow the same line of training on Ethical hacking methods.

[@QuickProgramming]

Thanks, am glad it was useful. And yes you can follow this kind of training for ethical hacking. Learning to protect yourself and learning to hack are practically the same coz in order to be well protected, you must know how hackers think and how they may attack. I may go into such tutorials in the near future

[@BlokeBritish]

@@QuickProgramming thnks. if u ever do a vid on the hacking bit, see if u cn demonstrate an end to end procedure of how to find bugs on a certain website, any real example target. u dont literally hv to get a bug there of course but whr to start like recon and right upto the point where bugs like xss sql etc can be searched for. i think the problem for ppl like me is tat most vids here r either just too much of theory , or too advanced. still luking for an appropriate tutorial on tat

[@valzzu]

Nginx doesen't allow you to look into folders at default.

[@friend8801]

please share the source code in description

[@QuickProgramming]

unfortunately i dont have the code for this project anymore. i lost it

[@s.s.scriptties]

Do I have to create the token as a column in the database?

[@abdomahmoud8769]

2:13:59 But the hacker can access the hidden input to get the token

[@QuickProgramming]

It doesn't matter even if a hacker can see the code. If he can see the input, it means he has a valid form since only valid forms have it. This system.only protects you from remote hackers e.g if a hacker sends you an image or link to click that contains form data. If that form is submitted, it will fail

[@ganherngyih]

the folder structure method work for WAMP? Doesnt seems to work for me

[@QuickProgramming]

it should work for wampp since it also uses apache server

[@kensyjolicoeur]

bro good Job, i really love PHP because of its simplicity, but when it comes to security 🥺🥺

[@19Sjoerd93]

How do I add MD5 encryption to the passwords? You answered: Simple $hashed = md5($password); But where in the code do I have to add this? I have tried many things but can't get it working... Hope you can help me out :)

[@riveraarcangelsabate1753]

why i try this but in vs code it so many error?

[@kos2222]

Do you know how to required the username and password to alphanumeric with minimum of 8 characters?

[@QuickProgramming]

watch this kzbin.info/www/bejne/r56znZWdr5t1pbc

[@pedrobrandao6107]

Excelent video. thanks a lot !!! I just add another topic that i think is very important to security: Hash the password using password_hash command. Thanks

[@QuickProgramming]

true, i use password_hash for my projects :))

[@pedrobrandao6107]

@@QuickProgramming good. I already add that to this example in the signup.php page but i'm capable to do the same on the login.php page. Maybe because i'm not a programmer. I'm just trying to learn step by step.... i have to discovery how it works on login page....

[@jNRoss123]

How do you connect the login to the index page or is this it? I also wanted to know how you would have login forms at the top of your page or directly connected to it.

[@QuickProgramming]

this is generally it, but if you need more understanding on how other files connect together, maybe you can watch this one where i turn an existing html template into a php website kzbin.info/www/bejne/o3yadJyAmr6Cras

[@websoftwaredeveloperijtiha3093]

Cheer Up

[@mosesgitahi2937]

can u share the source code for this. thanks will be easy for us as we learn Very good lessons

[@leozeld_nb]

Or you could follow the video instead, which is much better in my opinion.

@@leozeld_nb Yeah, people should put some effort into it at least. They won't learn anything by just getting the source code.

[@vishalwatts]

my code working fine on local machine but same code not working in online server please help _/\_

[@Akas766]

Thanks a lot.I am from Bangladesh.Make a another video with mvc + csrf token.

[@jeff3916]

Great tutorial! But I'm just wondering what was the $url_address for?

[@QuickProgramming]

its used in the url of a user's profile. its better than using a user id. this url: www.website.com/username is better than this one www.website.com/1234 it helps with google searches (SEO) because the url has the name of the person being searched

[@jeff3916]

@@QuickProgramming Great! Thank you.

[@hasanmahmudkhan966]

Great Work! Give your facebook, github link or email

[@QuickProgramming]

ive just created a github, i'll add a link, thanks

[@AWSanders7]

Good tutorial and easy to follow. Do you have a tutorial where you explain how to check the password field against the confirm password field on the signup form, preferably before submitting the form?

[@QuickProgramming]

i dont have a single tutorial but a series that uses AJAX, which is what is required to check the database without reloading the page. you can watch the series here: kzbin.info/aero/PLY3j36HMSHNWdM1oRHmFIOLxneqSZ6byi

[@AWSanders7]

@@QuickProgramming Thanks, I'll give it a try.

[@naughtylewis]

wow you are blessed my man good job

[@QuickProgramming]

I appreciate that

[@uuu5673]

do other people from other computers/ip's access the website?

[@QuickProgramming]

not on your local machine. but if the website is on the web then yes

[@rajkunwar1454]

code link please.

[@franklinodozie5329]

Please can i get the source code for this video ?

[@AlmaMat3r]

HI, Great tutorial, thank you. If you could give a hand I would appreciated, because I'm getting an error and I can't find where did I made the mistake... The error is the following: Parse error: syntax error, unexpected variable "$user_data" in C:\xampp\htdocs\login\public\index.php on line 5 And the code on this line is the following: $user_data = check_login($connection); I've already saw the video 3 times and I still don't know where to declare $user_data Can you help, please? Many thanks

[@QuickProgramming]

The error is on the previous line. Check to make sure it has a semicolon. If you won't manage to figure it out, paste the previous line here

[@AlmaMat3r]

@@QuickProgramming thank you very much!!! I got it... The bloody semicolon is always running away... =)

[@QuickProgramming]

@@AlmaMat3r nice

[@19Sjoerd93]

How do I add MD5 encryption to the passwords? Now I can read alle the users passwords, i want to get them encrypted so I can not read the password anymore when I am accessing my database..

[@QuickProgramming]

Simple $hashed = md5($password);

[@19Sjoerd93]

@@QuickProgramming But where in the code do I have to put this?

[@James-nk4sj]

I can't get the $_SESSION['token'] == $_POST['token'] to be true - perhaps the

[@QuickProgramming]

Make sure it has an equal sign like this:

[@James-nk4sj]

@@QuickProgramming Thanks so much for your reply. You were absolutely correct...

[@QuickProgramming]

@@James-nk4sj awesome. glad it worked

[@James-nk4sj]

@@QuickProgramming Me to - the inspect process should have made me realize as it was setting the token to the whole php command...

[@abdomahmoud8769]

When you host your website you can create a username and a password for the important directories so no one can access them without it

[@QuickProgramming]

anything with a username and password can be hacked. its better to simply deny access completely

[@FrankWerk-n8e]

How do i encrypt the password. I tried it with sha256/sha512/md5. but it can't parse to the db. some help?

[@QuickProgramming]

use password hash function e.g $encrypted_password = password_hash($text_password, PASSWORD_DEFAULT); and use the password verify function to check if the password is correct on login, e.g if(password_verify($user_provided_password,$password_from_db)){ //password is correct }

[@yash-fe2fe]

can you please provide us the source code file?

[@nahomsintayehu3139]

Thankyou.please link the source code in description

[@QuickProgramming]

unfortunately i didnt save the code for this project sorry

[@kemikkenya9794]

share the source code kinfly

[@kensyjolicoeur]

i am here for security

[@Parken26]

$username on the signup page is breaking my try at replicating this, can anybody point me in the right direction?

[@harmonreiner7992]

tags can be anywhere in the HTML Document. However, it is best to have it inside the

[@randomengineer8560]

It will be easier to learn with the source code, so we can fully focus on what you are doing.

[@BlokeBritish]

but isnt this too good for beginners Randy ?

[@pseudounknow5559]

@@BlokeBritishIt's a good tutorial overall but I have trouble to follow without the source code too.

[@QuickProgramming]

unfortunately for this particular tutorial i lost the source code. i dont usually pay attention to the code because i dont think it helps in learning. i'll save it for you next time

[@BlokeBritish]

@@QuickProgramming but u showed the code didnt u ? wat more source code is needed ? i dont get it

[@QuickProgramming]

@@BlokeBritish for some, simply watching the video inst enough. they need a text version of the lesson in order to learn properly. we are all different so i understand. its just that in my experience, having the text does not encourage you to type it yourself. you get in the habit of copy and paste. if you dont type it yourself, you learn very little. thats why i usually dont give the source code. to be a good programmer, you must type the code yourself to build muscle memory and you must also strive to solve errors on your own or with as little help as possible. having the source code does not encourage you to do any of this, since the answers are already there. when you're given a real life project, there will be no source code to look at. so i do provide the source code in some projects, on request, even though i dont agree with it

[@jefawk9603]

A lot of the same mistake most youtubers do: do low level front end. We're here for the back end, couldn't care less it's 4px or auto or blue.

[@QuickProgramming]

And this video was made just for your pleasure and specific needs, right? The sense of entitlement lol. Not everyone is a genius like you, genius. Some people do care if it's 4px or not. Simply get what you need and ignore what you don't. Plain and simple

[@2ncielkrommalzeme210]

Warning: require(../private/autoload.php): Failed to open stream: No such file or directory in C:\xampp\htdocs\beginner\public\signup.php on line 2 Fatal error: Uncaught Error: Failed opening required '../private/autoload.php' (include_path='C:\xampp\php\PEAR') in C:\xampp\htdocs\beginner\public\signup.php:2 Stack trace: #0 {main} thrown in C:\xampp\htdocs\beginner\public\signup.php on line 2_________________ i get this info in my pc after create sing up page . why and how can i solve it is in my computer or in google they said composer.

[@QuickProgramming]

This error means it can't load the right file. Check your folders to make sure the required files exist and the paths you typed is correct

[@2ncielkrommalzeme210]

@@QuickProgramming thanks i checked it but again will check windows 8 s defender efects it??

[@QuickProgramming]

@@2ncielkrommalzeme210 no it's not affected by the antivirus. Just check the file paths letter by letter. Take your time. It's the only reason why this can happen

[@2ncielkrommalzeme210]

@@QuickProgramming thanks your interest. i will do it.

[@gufababa7504]

Share me your source code please

[@Oddster1209]

ou bro i followed this tut to the end several times and i having problem on the 48:05 you put mysqli_query when i do that it says Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '.'2022-03-14 02:33:40')' at line 1 in C:\xampp\htdocs\login\log\signup.php:20 Stack trace: #0 C:\xampp\htdocs\login\log\signup.php(20): mysqli_query(Object(mysqli), 'insert into use...') #1 {main} thrown in C:\xampp\htdocs\login\log\signup.php on line 20 any help with these

[@EmmaMwesigye]

First of all i want to thank you for this informative and easy to follow tutorial. I am a beginner and was given an assignment by my superior to do a login page that would give access to our department help page so you can imagine what it felt stumbling on this. But now am getting this error when I try to signup ( Fatal error: Uncaught mysqli_sql_exception: Unknown column 'user_name' in 'field list' in D:\Xamp\htdocs\mylogino\signup.php:21 Stack trace: #0 D:\Xamp\htdocs\mylogino\signup.php(21): mysqli_query(Object(mysqli), 'insert into use...') #1 {main} thrown in D:\Xamp\htdocs\mylogino\signup.php on line 21 ) and I get this one when I try to login ( Fatal error: Uncaught mysqli_sql_exception: Unknown column 'user_name' in 'where clause' in D:\Xamp\htdocs\mylogino\login.php:20 Stack trace: #0 D:\Xamp\htdocs\mylogino\login.php(20): mysqli_query(Object(mysqli), 'select * from u...') #1 {main} thrown in D:\Xamp\htdocs\mylogino\login.php on line 20). Please help. PS: I even copied and pasted your code from the google files but the error still came up Thanks a lot again.

[@QuickProgramming]

the error says 'Unknown column 'user_name' in 'where clause'. so make sure you have a column named user_name in your database table