Tutorial: Membership System.

** Note ** Moderators please move this to tutorials, the section is read only. ** Note **

Hi, I am unidox and I am going to show you how to make a simple membership system. This included, registering for an account, logging in, security for pages, and logging out.

Now shall we begin? I say yes!

Our database will be setup like the following:

<?php
// This is how your DB will be setup.
/**
* | Table Name: users
* |- user_id 
* |- username
* |- password
* |- email   
*/
?>

Breakdown:

    user_id is the default value that keeps track of users.

    username is the users log in name.

    password is the users log in password.

    email is the users email, so in later versions of the member system, a forgot password can be added.

Our 1st bit of code will be a file named conf.inc.php. This file holds all of our mysql and function data, so we dont have to enter it over and over .

<?php
$db_user = ""; // Username
$db_pass = ""; // Password
$db_database = ""; // Database Name
$db_host = ""; // Server Hostname
$db_connect = mysql_connect ($db_host, $db_user, $db_pass); // Connects to the database.
$db_select = mysql_select_db ($db_database); // Selects the database.

function form($data) { // Prevents SQL Injection
   global $db_connect;
   $data = ereg_replace("[\'\")(;|`,<>]", "", $data);
   $data = mysql_real_escape_string(trim($data), $db_connect);
   return stripslashes($data);
}
?>

Breakdown:

    The 1st part is all the mySQL information in order to view and insert data.

    The 2nd part prevents SQL injection, so people cant gain unauthorized access.

Our next file will be register.php, it will allow users to register an account so they may login and view parts of the website that others cant.

<?php
include("conf.inc.php"); // Includes the db and form info.
if (!isset($_POST['submit'])) { // If the form has not been submitted.
echo "<form action=\"register.php\" method=\"POST\">";
echo "<table>";
echo "<tr>";
echo "<td colspan=\"2\">Register:</td>";
echo "</tr>";
echo "<tr>";
echo "<td width=\"50%\">Username:</td><td width=\"50%\"><input name=\"username\" size=\"18\" type=\"text\" />";
echo "</tr>";
echo "<tr>";
echo "<td width=\"50%\">Password:</td><td width=\"50%\"><input name=\"password\" size=\"18\" type=\"text\" />";
echo "</tr>";
echo "<tr>";
echo "<td width=\"50%\">Email:</td><td width=\"50%\"><input name=\"email\" size=\"18\" type=\"text\" />";
echo "</tr>";
echo "<tr>";
echo "<td colspan=\"2\"><input type=\"submit\" name=\"submit\" value=\"submit\"</td>";
echo "</tr>";
echo "</table>";
echo "</form>";
} else { // The form has been submitted.
$username = form($_POST['username']);
$password = md5($_POST['password']); // Encrypts the password.
$email = form($_POST['email']);

$q = mysql_query("SELECT * FROM `users` WHERE username = '$username' OR email = '$email'") or die (mysql_error()); // mySQL Query
$r = mysql_num_rows($q); // Checks to see if anything is in the db.

if ($r > 0) { // If there are users with the same username/email.
	exit("That username/email is already registered!");
} else {
	mysql_query("INSERT INTO `users` (username,password,email) VALUES ('$username','$password','$email')") or die (mysql_error()); // Inserts the user.
	header("Location: login.php"); // Back to login.
}
}
mysql_close($db_connect); // Closes the connection.
?>

Breakdown:

    We 1st include the database details and make sure the form has not been submitted. If it has not been submitted then we display the register form.

    If the form is submitted, we make some variables so we can incorporate the form() function.

    We then make sure that the users email or username are not already in the database.

    Then we insert the user into the database and redirect them to the login page.

The next page is login.php.

<?php
include("conf.inc.php"); // Includes the db and form info.
session_start(); // Starts the session.
if ($_SESSION['logged'] == 1) { // User is already logged in.
header("Location: index.php"); // Goes to main page.
exit(); // Stops the rest of the script.
} else {
if (!isset($_POST['submit'])) { // The form has not been submitted.
	echo "<form action=\"login.php\" method=\"POST\">";
	echo "<table>";
	echo "<tr>";
	echo "<td colspan=\"2\">Login:</td>";
	echo "</tr>";
	echo "<tr>";
	echo "<td width=\"50%\">Username:</td><td width=\"50%\"><input name=\"username\" size=\"18\" type=\"text\" />";
	echo "</tr>";
	echo "<tr>";
	echo "<td width=\"50%\">Password:</td><td width=\"50%\"><input name=\"password\" size=\"18\" type=\"text\" />";
	echo "</tr>";
	echo "<tr>";
	echo "<td colspan=\"2\"><input type=\"submit\" name=\"submit\" value=\"submit\"</td>";
	echo "</tr>";
	echo "</table>";
	echo "</form>";
} else {
	$username = form($_POST['username']);
	$password = md5($_POST['password']); // Encrypts the password.

	$q = mysql_query("SELECT * FROM `users` WHERE username = '$username' AND password = '$password'") or die (mysql_error()); // mySQL query
	$r = mysql_num_rows($q); // Checks to see if anything is in the db. 

	if ($r == 1) { // There is something in the db. The username/password match up.
		$_SESSION['logged'] = 1; // Sets the session.
		header("Location: index.php"); // Goes to main page.
		exit(); // Stops the rest of the script.
	} else { // Invalid username/password.
		exit("Incorrect username/password!"); // Stops the script with an error message.
	}
}
}
mysql_close($db_connect); // Closes the connection.
?>

Breakdown:

    1st we include the db and function file, and start the session, telling the browser that sessions will be used.

    We then make sure the form has not been submitted in order to show the login form.

    If the form has been submitted we make 2 variables for username and password. We encrypt the password with md5() so it is a bit more secure. (To all those who are experts in PHP, you would normally salt a password to make it harder to crack, but for beginners stick with md5())

    We then have a query checking the database if any users match the username and password, and if there are matches it will be counted in $r.

    If there are matches we set a login session.

Now we will make logout.php.

<?php
session_unset(); // Destroys the session.
header("Location: login.php"); // Goes back to login.
?>

Breakdown:

    We destroy all sessions and forward the user to the login page.

And last but not least, the page where you want only logged in users to view.

<?php
include("conf.inc.php"); // Includes the db and form info.
session_start(); // Starts the session.
if ($_SESSION['logged'] != 1) { // There was no session found!
header("Location: login.php"); // Goes to login page.
exit(); // Stops the rest of the script.
}
echo "This is the main page!";
echo "<br />";
echo "<a href=\"logout.php\">Logout?</a>"
?>

Breakdown:

    We include the config page.

    Check to see if the logged in session is set, otherwise forward user to login page.

    Allow the user to log out if needed.

Well thats the basic member system, I will add as people request more. If you have any questions please feel free to post and PM me, I am more than happy to help!