1. Project Architecture & Requirements

In this capstone project, we build a production-grade, secure User Authentication System with registration, password hashing, database verification via PDO, session management, and logout.

2. Database Schema

CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    name VARCHAR(100) NOT NULL,
    email VARCHAR(150) NOT NULL UNIQUE,
    password_hash VARCHAR(255) NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

3. User Registration (register.php)

prepare("SELECT id FROM users WHERE email = :email");
        $checkStmt->execute([":email" => $email]);

        if ($checkStmt->fetch()) {
            $error = "An account with this email already exists.";
        } else {
            // Hash password securely with Bcrypt
            $hash = password_hash($password, PASSWORD_BCRYPT);
            $insertStmt = $pdo->prepare("INSERT INTO users (name, email, password_hash) VALUES (:name, :email, :hash)");
            $insertStmt->execute([
                ":name" => $name,
                ":email" => $email,
                ":hash" => $hash
            ]);
            $success = "Registration successful! You may now log in.";
        }
    }
}

4. User Login (login.php)

prepare("SELECT id, name, password_hash FROM users WHERE email = :email");
    $stmt->execute([":email" => $email]);
    $user = $stmt->fetch();

    if ($user && password_verify($password, $user["password_hash"])) {
        // Regenerate session ID to prevent Session Fixation attacks
        session_regenerate_id(true);
        $_SESSION["user_id"] = $user["id"];
        $_SESSION["user_name"] = $user["name"];
        header("Location: dashboard.php");
        exit;
    } else {
        $error = "Invalid email or password.";
    }
}

5. Protected Dashboard (dashboard.php) & Logout (logout.php)

Welcome to CBT Dashboard, !
This is your private student / admin portal.
Secure Logout