Part 7b

Make sign in and register work: PHP sessions, checks, hashed passwords and a protected account page.

#digital technology #gce #parkwood vale #wjec

← Previous part Next part →

We connect the forms from Part 7a to the database. Users can register, sign in and reach a protected account page, and passwords are stored hashed. In this part: 0:00 A correction: add your database name to connection.php 4:03 sign-in.php: reading the form data 8:20 Checking for empty fields 12:40 Looking up the user in the database 18:25 Sending a failed sign in back with a message 20:41 Showing the message once with sessions 28:16 Renaming the page to login.php and skipping it when already signed in 31:14 Storing the user's details in the session 35:00 Making account.php a protected page 39:17 signup.php: checking the registration form 46:00 Adding the new user to the database 54:22 Hashing passwords Forgot password is built in Part 8. Software: Adobe Dreamweaver, UwAmp, HeidiSQL, PHP, MySQL.

Transcript

Welcome to part two of this week's session then.
So in part one, if you skipped over it, that's perfectly fine.
What we did was we set up our sign-in form, our register form, and our forgot
password form. In part two, we're going to have a look at the PHP in the back end of
this to see how we check against that database to verify this information.
This is the transactional element of our transactional website.
So let's begin.
Okay, James from the Future here, just two seconds of your time then.
I've had a couple of people come to me with issues, emailing me.
We've been going back and forth trying to figure out what the issue is, and it's
always come back to the same thing.
If you're on video 7B, which this has just been spliced into, then you're probably
working on the section, if I can just get my file section open here, where it is the
reset password element. So password reset, going through this section here, sending
the email, I'm finding that you're having issues, perhaps with a register section as
well, where it's giving you random issues and you're not too sure why.
It seems somewhere within the video series, some people have seen it, some people
haven't seen it, but there's a small change to this connection config file.
So in my connection folder, in my, sorry, config folder, in my connection file,
I have mine set up that looks like this.
It has the database in place and it's got the database name.
That database name comes directly from within my
UwAmp folder. So let me just make sure UwAmp is running a second.
And within that UwAmp section, then when it is up and running, and I can connect to
that database and it will allow me to see what that database is called.
Obviously, this is gonna be unique to each of you.
If you're just plainly copying my database set of my structure and my everything,
then it will still be Parkwood Vale.
If you've adjusted it in any way, it will be whatever your database is.
So I'm just connecting directly into Heidi here.
We've got Parkwood Vale, and in there is the name of my database.
So in this section here, the change that needs to happen
place. Yours may well look like this.
And that is that we have connected to our backend database, but we haven't
told it specifically which one we're looking at.
And if I go back into Heidi here, then you'll see there's an information schema,
there's a MySQL, my park reveal database I want to use, a performance database, a
phpMyAdmin database, and a sys database.
They are all available on that connection.
So when I connect a local host using the username root and password root like I've
done so here that will work fine but it won't know what database to use.
So the change I've been saying to people to make is simply put in db equals and in
speech marks then the name of your database.
In my case Parkwood Vale. Now that's brilliant to set that up there and again put in
the comment saying this is the my
small y SQL database
name which is brilliant in this connection we also need to edit
this here then we need to add in the end here just simply tell it to use the DB we
wanted to use and that way there that should pick up use this DB and slot
it directly in place if you having issues then with 7b at all please
check this connection file please make sure you've got that in place i'm going to
slot this at the start of 7b so hopefully you do this before going further forward
if it's still not working by all means reach out email me and i'll give you some
support on how we can get that working okay thank you back to the video
okay so back in the student desktop then i'm going to start off with our sign in
function So I'm going to go over to my site.
I'm going to create a new file.
I'm going to call this sign in dot PHP and just drop that dot HTML off
the end there. Open that up and delete all of that out.
With that sign in setup, then we're going to tell it that we are working in PHP.
And the very first thing we have to do after the clear our PHP tag is start a
session. Now, a session then is a,
simply put, a session is a cookie stored on the PHP
server. Cookies can store data, they can store information about where you've been,
what IDs you've clicked on, what different elements you've used.
Sessions work in the same way.
A session will have a session ID that every time we go back to it, it knows which
session we're running from.
and that session can be used to store information on our php server
securely so that we can include information such as login information
so i'm going to start my session at the top there then the next line i'm going to do
is i'm going to include so i want to use my server so i'm going to include my
config. So config that's just there forward slash
connection dot PHP.
So that knows then that while running this sign in page, I need to be referring to
this page here.
That's set up then. What I'm going to do is start by looking at how we output
information. So let me just save that a second, push that for a second and open up
my page. As you can see,
place already if i click on submit it comes back and says sign-ins not found let's
see sign in i did that right i didn't push the sign in page there i did that folder
all right if i reload that yes i do want to continue and it comes back with nothing
it's a blank page it hasn't done anything yet what it's done is started a session up
and included my connection and that's it What I can do is I can print
underscore R and from that print R command, I can use my dollar
sign underscore post to access my post array.
And actually, if I just leave it like that, it should print the whole of my post
array.
Now, let's put that up, refresh my page, click yes to continue.
And you can see that I have sent the information in the background of email is cpd
at mrjjones.co.uk.
is blank they come directly from my account page
where I set them up here and I've given them these names here email and password and
just to show that this underscore is underscore
a demo save that let's check that page back
up go back to it and refresh it just so that it knows for my password in and
email let's try that again and make sure we put it up the right page account but
there we go let's put that there refresh this and just a double check and going to
inspect that there this is a demo in the name so that should all work as I expect it
to and if I put my email address in and submit it it now says this is a demo just
like it should have done first time around which would have looked so much more
slick never mind but any name I give it there is the name that I'm referencing as I
go forward. So let's put that back to email, save that, put that,
and jump back into this section here.
I can directly target one element by referencing its location
within my post array. So I've got my print email there.
If I save that and I go back to sign in and put that page up and I go
back, refresh this page to make sure it's updated,
submit it and it just gives me my content.
So we're going to use this element, this way of passing information to check if the
information is empty.
First thing I want to do is I want to set up an array.
It's going to be called errors and it's going to be a simple blank array.
Now I'm going to say that if and I'm going to use a negative on is
set so that negative element means not so if it's not set in this section
here then I'm going to go into the next line I'm going to say dollar sign
errors and I'm going to reference
anywhere within it and just simply say the email
field must be
must not be empty like I say must be complete must not be empty same
sort
I'm going to repeat that process for my password.
So I'm going to say password.
And under here, I'm going to say the password field must not be empty.
So that's going to check to see if my post email and post password have been set.
And if they haven't been set, it's going to give it an error.
So I'm going to say then that if, again, negative empty errors.
errors so I'm checking if errors contains anything if errors does contain
something then I want to redirect my user back but to start with I'm gonna just
simply print underscore errors
print are errors let's do that right let's actually
put it in the correct language.
Save that, put that, and refresh our page and see what happens.
Continue.
It's come up with nothingness for me there so far.
So according to that, then it's quite happy that I've entered everything in place,
but I know for a fact they haven't.
So let's go back and just double check.
Submit and it's not giving me my errors.
So if is set, we should have been able to do this in one
line without having to wrap in braces, but let's check some braces in just to be
safe.
There we go. So if password is not set.
There you go.
And let's just for a second print errors to see if it is working as
expected.
Post that.
Refresh our page. It is giving me an empty array.
okay so if is set post do to do to do
why is that not if empty
let's
try that one
there we go it's set was the wrong command it's not empty so if i remove that for a
second then and try that again post that refresh
my page it says that the email field must not be empty if i go back
and i empty the email address don't save that page i submit that page
if not empty if of course
and post that so with that fix in place what i've done is taking the negative away
saying if it's empty for email if it's empty for password then put it into errors
and if errors isn't empty then print it so now if i refresh this we get
email must not be empty password must not be empty and they are stored.
So we've got some basic detection in place.
What we could do at this stage here then is redirect our user back to our login page
with a message in session telling them that's error but we're gonna go a little bit
step further forward first. I'm gonna say else so
thank you Dreamweaver
otherwise if it is if it's not empty so if my error here doesn't
does contain
then what I want it to do is process it.
This is where our SQL commands come into place.
I'm going to do a very simple select to start with.
So I'm going to select, I want to know the email.
I want to know the, let's double check in Heidi first.
Before I jump too far ahead, let's see what we've called them.
So let's open up Heidi on Parkwood Vale in my users table.
I have called them email for name surname so that's what I want to bring back email
for name
surname from and it's going to be our users table
where and this is where we're going to start pulling in some information
now I'm going to start off first of all saying email equals
and I'm going to put in single quotes.
I'm going to say and password equals and I'm going to put in single
quotes and terminate that command there.
Now there's my SQL section and I want to put in place my
post email and post password in those sections there.
So at that point I need to break out of my PHP command using my speech
marks, use four stops as a joiner and put that in place.
I'm going to do the same thing here.
Break out of it, four stops, and join.
And the password element is going to come here.
Now, I can echo that
$SQL command so I can see exactly what's going to be run on
my server.
I come back here for a second and I go back here and I put in my email address for a
change and I put in password 123
as you can see and submit it. I don't get anything being shown.
Okay so let's see what's happening.
If error is there, no. So SQL, print SQL.
well. Let's go print dollar sign errors.
Ah, same old error, human error, I forgot to
click put.
Refresh and there we go. That's as I'd expect to see it.
It wants to select this information from my database.
Now if I copy that using the copy command into a query here as you can
see I can just paste it and run that query it finds my one user row
for me.
So what I need to do next knowing that works and gives me my right output is check
how many results I've got.
I can use another if command and the if command is going to check to see where my
connect up my query or what number of results are in my query
now I've created my query but I haven't yet run it
so what I need to do is store the answer somewhere I'm going to store in a variable
called result I'm going to say equals connection I'll explain where that comes
from in two seconds time and the is going to query
simply SQL.
And it is $sql because it's my variable and that's going to run there.
Now if I save that for a second I want to explain where this connection comes from.
It comes out of my connection PHP page which if I open that up it's done here my
connection is a new SQLI connection.
So it's using that connection to query my database.
Now in here as I was typing
say is dollar sign results so I'm using a result variable and I'm going to
check a property in there called num underscore rows
and it's going to check to see if the number of
rows is equal to one so
realistically in your database you should only ever have one
match on an email and password
If there is a match in our email and password combination, right now I'm going to
just echo simply, userFact.
If there's not,
I'm going to echo simply, so else, echo,
and I'm going to say, no
userFact.
Now, with all of that in place, let's save it.
Let's not make the same mistake I always make.
place correctly and there's that there.
If I was to refresh this page now, because the information is still on my server, it
should come back with user found because it's found my single user, which is jjohns.
I'm going to my table here though and change the password to password 1234
and then refresh it. It will say no user found because it's going through our logic,
it's performing our query and it's saying whether it's found our user or not.
So there is our basic elements.
Now we have in place three checks.
We have a check to make sure it's been entered correctly, we have a check to see if
there are any errors, and we have our check to see if the user exists.
If the user doesn't exist or if we get any errors here, what we're actually going to
do is redirect them back to that login page.
The way we do that is we set the header information within our PHP and we say that
the location within our header should be and then I can go full
stop backslash account and that's going to take me back to my account page now
we have that session in place and we can use that session for our error
messages so dot sign underscore session and session just like post is
a array and i can put in place here a message to pass in so i'm going to say
sign in error and is going to be equal to
and i'm simply going to say
um well realistically we don't need to tell them which one shouldn't be empty we're
going to say error on the signed in page and just have
that set in place that should if i delete that print now redirect me
straight back to my account page when one of these elements is empty but i won't see
this variable and i'll explain why in a second i'm going to use this same setup here
i'm going copy this across and that is going to go in for my no user found here and
i'm just going to say
it's not anymore it's gonna be instead you have
supplied incorrect
user details now we never actually state
what user details are incorrect just the fact that they are incorrect we wouldn't
want to have a system whereby the user can guess the username and password
combinations by repeatedly over and over going through knowing which one is correct
if i save that for a second and i got my sign in and i push that
and i refresh it because there's no use of fun what i'm expecting to happen is
just to be taken back to my account page and i have brilliant
i'm now going to go onto my account page and in my account page
I'm gonna have a look at what I can do to make sure that I can see that
information at the top here so I've included my header here and what I want to
do is just simply check to see if the submission if my session has
any errors within it so I'm gonna put in place before my
include header because remember session has to be the first thing it sees session
and I want underscore start
so that knows then that that session is on that
page and what I'm going to do is I'm going to go down to where my sign-in form
actually is and in my sign-in form section I'm going to add in a paragraph
i'm going to put it in and say simply php
i want to echo dollar sign underscore session and
the session i want is to echo out not the connection page sorry
my signing error
and i'm going to terminate that and end the php now this will give me
some errors you'll see them
this well it didn't i was expecting to see an error at the top telling me there are
no signing errors but if i submit this now it is refreshing and coming back
and the reason i didn't see the errors when i expected to see the errors was i
forgot to put that site let's go there refresh it
still no errors mind and we're not getting that very strange uh
echo session sign in there
account let's close all of these down let's make sure that i push the wrong page
there we go
and there's my error that's what i expect to see an error on the sign-in page
because something has gone wrong if i put in this details and i put in the password
there and i submit it it says you've entered the wrong user details
so back on here then back on my account page
to it here just to bring the users deep attention to it a bit more
I'm going to add some style to it so I want a span tag for it and I'm going
to style this using the old-fashioned style methods equals
and I'm going to set the color to red nice and simple
now my span is there in place I'm going to take that
and place that at the end here and I've got that set up.
I could go class again and text
center
Let's count, push, refresh that.
You supplied incorrect details.
I've also supplied incorrect element there.
class tt equals
American isn't it center taxos attack
center will double check in a second nope
okay so Dreamweaver
and doesn't want to center that text so I'm just gonna leave that class element out
style
text align
center we'll do it that way but
that way instead
and let's refresh that still doesn't want to center it no matter what i do never
mind and takes the line center there so we've got that error in
place but if i go back to home and i load my account it's going to tell me that i've
entered incorrect details which realistically i haven't there shouldn't be anything
in my session
what i wanted to do is when i go onto my session page here i wanted to start
my session i wanted to display the error and then i want to remove the error from my
session so that it's no longer there no longer to be seen and therefore i don't
have to worry about it so at the very bottom here i've included my footer and then
i'm going to go in the very very last line and i'm going to do session.
And what I want to do is session destroy to get rid of my session afterwards.
So what it should do is load my session, display my error if there is one, and then
destroy the session so then there's no issues.
Copy fail. And that's still coming up with my issue there.
Did I put that?
I'm going to put a post-it note on my screen saying to put.
There you go. Now, this was that error I was talking about earlier.
This error is telling me that there is no session information to be used
and it's trying to access it on line 32, but it doesn't actually exist.
So line 32 is this one here where it's saying to echo it.
I'm going to say, even if I put is set or
that error what i can do instead is i can control the error messages i get presented
with and by controlling those error messages i can actually decide
what is going to be logged to me and what isn't i'm going to go through that one
with you a little bit later on so the the errors aren't really going to cause as
much error at the moment so if i submit that i get that error page if i go back to
it this now says that I'm under find index signing so there it is we can
check but I'm fairly certain that if I put in place on here if
not empty
I did dollar sign underscore session
and I want to see if that
section isn't empty
to see if that section has that key in place and it's going to give me the same
error.
But let's give it a go anyway.
Let's go part of the bell,
count. Oh, that did solve that error.
There we go. It doesn't usually do it, but it's quite happily done it there.
123 this time.
There we go. And password1234 submit
is taking me to user found.
It's at this point here then that we would take them to their account page, their
personal account page, as opposed to the login page.
Now I've got this page here called account.
and what I'm actually going to do is rename that to login because it makes more
sense.
I'm just going to very quickly change this to login.
I'm going to put the login page up because let's face it I forget that plenty of
times anyway and I'm going to jump into my www file just find the account
page here. Don't want to do that and I'm just going to delete that to remove it.
So I've got that login page there instead.
I just need to go to my header.
And in my header, where the menu is, now bar, I can expand it out and
I can go to
account is actually linking to login.
Now, that's all set up. That's all in place.
I can now log in with my page there instead.
What I'm going to do is open this login section here and it's got my start session.
It's got my if empty element for that element there.
I'm also going to include, I'm going to check to see if I
have a session in place and I'm going to check actually to see if something has been
stored in session specifically.
I want to see if session email has been stored.
So I say grab that from there, session starts.
Before we include anything, let's just double check to see if session email
exists. And if it does, I want to change the header again
to location.
And the location this time around is going to be account.
I know we just deleted account.
We are going to recreate account, but it's going to be my login account page.
So I've got, does my session contain my email?
If it does go to the account page.
So when I come onto here, the logic behind this is,
account doesn't exist now. I know it doesn't.
Let's go back to localhost. If I click onto account, what it's actually going to do
is take me to login. when I go to login login will check to see if
I'm logged in and if so redirect me directly to my account first now my header file
wasn't uploaded properly because as we saw two seconds ago when I hovered over my
menu account didn't say login it said account okay
so that's set up then I'm going to go out of these two.
I'm going to open up my login function.
That's perfectly fine. I'm going to open up my sign-in function and I'm going to use
a similar setup here in this user account found.
So let's highlight that, drop that in place.
It's going to be email.
But this time around, rather than having that set there, I'm going to be referencing
part of this section here, part of my result.
And to do so, what I need to do is create a small loop to go through my result.
There's only one entry in there, but this will allow me to say dollar sign row
equals result, dollar sign result.
And I want to fetch the
associated results.
Now that's going to create for me my loop.
It's got my result here. It's fetching the associated results.
And inside this loop here, what I want to do is set different parameters.
I've told it, I want to check if my email, forename, and surname from users
matches.
here which would then be from my dollar sign row as it's
coming out and using fetch associated it uses names I can simply say email
I can do the same process here and here and instead of email I can do
for name and surname and And
again, copy these elements,
paste them there.
So while I've only got one result, loop through that one result, storing the details
in session, and then redirect me to my account page.
Obviously, this one here now needs to be login, and so does this one here.
Login. Nice and simple. So I've got those in place.
it allows me to sign in and where I'm signed in it will put me in the right place I
just need to bring one more piece of information back and that is whether they are
an admin or not so I've got admin here I could do loan tokens as well but for now
I'm just gonna check is admin so I'm gonna go comma is admin I'm gonna
highlight this section copy it and paste it I'm gonna say is
admin and over here install that
now if I was deciding with the correct details so jjones
password one two three four and submit
it says user found because I forgot to press
it's still saying user found i haven't told it to say user found anyway
sign in put that there refresh that continue
it's trying to go to account but account doesn't exist
so let's just go in very quickly new file account dot
php and save that
Our account.php is going to be a PHP page.
We're going to do session underscore start.
And I'm going to print underscore R simply dollar sign
underscore session to get all of my session
variables out and save that.
If I refresh this page now, no.
put and refresh this page now, we get our variables that we have set where it's
my details and it's in place.
Where I got session start then, I'm going to take apart from this page here and I'm
actually going to do the opposite.
So on account, I'm going to say if session email is empty,
redirect to login.
Now, if I go to my login page for a second, because that clears my session, it has a
delete session at the end there.
If I try to go to account now, because that should be empty,
if empty, I suppose I could just do
session entirely.
So if empty session, I put that
and refresh this. Because session is empty, it takes me back to my
login page. So I can't actually access that page without being logged in.
Again, wrong password, not allowed, right password.
and load in and I can access this page now, which I couldn't two seconds ago.
So that's given me my secure login system to access my database.
I'm providing a very simple element where I'm querying my database to get my user
details. If the user exists and there's only one user with those details, then log
me in, store these details in session and redirect me to a
Otherwise, tell me there's an error, take me back to the login page.
Now while we're here, what I'm going to do is go on my account page.
I'm going to go to my index page.
I'm going to take this top section onto account
and paste it. Don't worry about that error.
I'll fix that in a second. and this bottom section, copy it
and paste it and the only issue we should
have, let's correct
that and that and then I'm going to come out of
PHP that goes back into PHP correctly and then here I want to go back
into PHP.
Here we go. Now if I save that and actually remember to put it for a change what
will happen is when I refresh this page now it's there and it's written in place but
it's just not seen.
On index what do I want? I want my colored div element as well.
Div and Div.
And save that.
Put that.
Refresh the page.
And there we go.
in place. We have our account page here which when we go to it, it takes me to my
login and actually logs me out.
It's a bit of a strange function.
We will address that but right now we have our basic login facility.
The next one up we're going to do is our forgot password.
Quite an easy system but it does involve some emailing elements so we're going to
jump into that in about two seconds time.
Okay so next up we were going to look at forgotten password but after a little bit
of testing doing forgotten password via UwAmp's mail system didn't seem to be sitting
as comfortably as I'd like it to so I'm going to come back to that in a further
video. We're going to go on to register any users so we can sign in and register
users this session and I will come back to forgot password.
A lot of the logic works it's just the mail section side of things that isn't as I
want it to be.
So let's start with our register page then.
So we have our register section here.
In our register page we have our for name, surname, email, password, password
repeat and we have our terms and conditions elements.
What we need to do is set up the register process element which I'm going to call
sign up. So let me right click and go for new file.
I'm going to call it signup.php and let's get rid of that element there.
I open up the sign up it's going to be the similar job get rid of all of that
element and actually from sign in quite a lot of this can be reused.
So I'm going to copy that from my sign in page, paste it here because we still want
to connect here. We still want to have a session started at the top with it and we
still want to check if our email and passwords have been entered.
We also want to put in place a check to see if our forename
and our surname have been entered to make sure that they are there.
And with our passwords
I want my password. I want to double check.
I'm sure I called it password repeat.
I did password repeat and put that in place as well.
The whole name.
Now I am going to put these in place just because syntactically it makes it look a
bit nicer just so I understand what's going on.
It doesn't need a capital R anymore and that's in place.
That will take me back now instead of going back to my login page it should go back
to my register page and I should be able to put that in place
that's my sign up page if I up that can't believe I didn't forget to do that part
it's posting to my sign up page I did change my mind on that name there so
register let's post that up and let's go into my register
here we are submit it it's saying it can't find sign up of course it can't
sign up dot PHP put that there
and it takes me straight back here
it's not giving me the error information because I added that on my login
page and I haven't added that here yet so login let's jump back here we got that
that but we do want to have this span tag here
copy that and sign
register page sorry not sign there we go save that
register let's put that a couple of times just so we're sure of it submit it
And again, it's not giving me my error.
Ah, because I did forget how can we reference anything in sessions if
we don't have our session started at the top there.
There we go. Register page. Put it.
Submit it.
Come on.
So register starts the session.
If the session sign in errors, let's go on to my sign up page.
Session sign in error. Yes, that's there.
Okay, it should be register error, but I'll do that in a second.
Print that there.
So sign in and log in and go. We've got register and sign up.
put that, put that.
There you go, error on this sign-in page.
Need to correct it ever so slightly, but we've got that basic element in place.
On here then, it's not an error on the sign-in page anymore, it's an error on the
register page.
And we're working in sign up, so let's just put that.
Okay, brilliant. We've got all that in place.
Let's correct this before we go any further.
It's not a sign in error, it's a register error.
That one shouldn't need to exist so I can get rid of that.
And on here it is register error, register
error, save that and let's put those two pages up.
And let's just double click it.
Perfect, right, all in place then.
Let's go through and see. Well, I know what happened, but if I put this in, it's
telling me it needs to be an email address.
So one at two dot com, easily faked,
and it's gone through that process.
So on our sign up page then, we have checked for errors.
We haven't gotten any errors, so we're at this stage here.
We didn't redirect to our login page, because I've just got rid of that command, and
I'm gonna get rid of this section here as well.
What I want to do this time around, rather than doing a select, is I want to insert
that information.
I want to insert into users.
Now, I'm capitalizing this. When capitalizing is best practice, it's best practice
as it is. You can or you can't do it.
It doesn't necessarily mean either way is right or wrong.
Realistically, I should have done it the other way around, but I didn't.
My bad. So I'm going to insert into this.
Let's have a look a second. Our email, our password, our forname and surname and is
admin. I'm not putting the town stuff in just yet.
That will come at a later stage.
And so I'm going to insert loan tokens as well.
So let's go comma loan tokens.
And that's there. So I'm inserting into users these values.
then I'm going to go over here and what I'm going to say is values to match
what's going on here
are and I don't need to do the referencing them individually but
what I do need to do is include all of them so values open bracket
this time around I'm going to start off with not email because it will
put the first one into the first one so email should be right actually
going to say for name.
I'm going to do a comma. I'm going to do surname.
And I'm going to do comma.
I got for name, surname. I got is admin.
And let's try and just tidy this up as we're doing it, shall we?
So it can be on multi-line. It doesn't have to all be on one line.
so going like that just works nicely just to separate them out so i can see what i
have and haven't done so comma there i got four email phone name
surname is admin
comma i got password i haven't got up here i will deal with that in a second because
i want to do something slightly different with password i say loan tokens
and actually these two here
going to be different. I'll deal with that in a second.
And then comma, password.
Email will grab from our post.
Forename will grab from our post.
Surname will grab from our post.
Generally speaking, when we add a user to our database, they are going to be a user,
not an admin. So I'm going to put a zero in place.
When we add a new user to our database, they're going to have three loan tokens.
So I'm going to put a three in place.
As these are numeric values, they don't need our speech marks.
They are integers, they are not strings.
Password hasn't been included here then.
Let's correct that. Password.
And have that there. So that's now inserting all of those elements into
the correct place. That should be right there.
Perfect. So there's my SQL command.
If I want to run that, all I've got to do instead of a result is connection,
query,
So if I save this for a second and I have a look here, you can see there's only that
element there. If I refresh this page and resubmit that information and then refresh
my database, we get no changes.
Let's have a look. Why? Probably because of one simple thing.
Sign up. Put.
Put. Now, let's try again. Continue.
And refresh.
Still nothing. Let's see what's going on.
So there's my SQL. Let's go echo
$sql.
Save and put that and refresh.
Enter into users, these values here.
Brilliant. Let's copy that into Heidi.
Run that as an SQL command and see what it tells us.
street name doesn't have a default value.
Right. Okay. So in my data, in my table setup, what I've got here is street
name, no default set already.
I'm going to say I will allow it to be now.
Town and postcode are probably going to give me the same error.
So let's save that and go to my query, run my query.
And now it appears. If I try and run it a second time, mind,
Because the primary key is already taken.
Now, if I go into here and I refresh it, continue, I get no
difference in place there. What I need to do is check to see what happened with my
connection here. So I can say if, and do an if command on it,
my query is triple equal to true.
and what that will do is make sure that it's not only run but if there's any errors
it will let us know what the errors are and then I'm going to say echo
error and to that error I'm gonna put in
dollar sign SQL
there we go so there's my query so that's the SQL command I'm
gonna say
br to go on to the next line and simply then do dollar sign connection
and i want to know the error
so if it works do nothing at the moment if there's an error tell me what that error
is
let's put that up let's run this and it's saying
insert into there there's my query error insert into there let's get rid of that
there it says primary key there's already a primary key for that user that user
already exists within my database realistically that should be the only errors we
get back is the fact that that that primary key already exists so we could say that
the account exists and redirect people to forgot password
For now, I can insert into it.
I don't want to echo that there for a second.
And I've got this section here.
If the user has signed up, I'm not going to take them to a login page, as a lot of
websites do. What I'm going to do is I'm going to use the sign-in function here.
I'm going to take the details from this section here.
And I'm going to emulate what's happening here in the sign-in.
so if there are no errors I don't have to do my while loop but what I do need to
do is say session is equal to and then this time around it's going to be my post
email that's going to be the same thing post underscore
for name and post underscore surname and as they're registering I know
that's a zero so I can set that there.
So let's put that in place. All of that's there.
I don't need that extra brace.
Just tidying up some of these indentations a little bit and put that there.
Okay. So if I
put that again and I go into my data and just simply delete number one,
two for a second, there we go that no longer exists if I go into here
and I go back to register one I'll say two password one
password one submit and it's inserted those values for me
no problem didn't redirect me but if I refresh this
it has inserted it so it's definitely done my insert
there but for some reason it didn't actually redirect me let me save this
and sign up put that again just simply delete this
user a second because i'm thinking it's my error for not
there we go and it's taking me to this page now it's going to give me this sign in
error there's this error on the sign-in page, fair enough, tell me that, but the
email details, it has got my details in place.
I'm not sure why it's got a sign-in error there.
I will deal with that one, but we have that in place.
Password repeat, password repeat, just top and 10 in those.
Now, that is a very basic form of setting up a sign-in.
Password's there, username's there.
I could then go to login and now logged in if I
did 1.2 and my password I said was 1 click sign in
it would sign me in because it's taken the details that I've added in place
it's not the most secure
I don't know how you feel but if I knew that every website I went
on to and I registered with had a database where they could see my username and
password used in plain text, I wouldn't be very impressed.
What we can actually do to try and be a bit more secure
with this is tackle this password element here.
Now, when setting up our passwords, it's always good
practice to hash the password in some way, which just adds an
element of encryption to it.
the hash function in php allows you to do this without having any additional
needs so i'm going to put in a char let's say 512 encryption on my password
and that is to there to put
that in place there now if i was to save this sign up and i was to
post that sign up there delete one two again
and just go back to accounts. I want to register.
One, two. I'm going to put in one and one for the passwords.
Submit them. It's put me in places, registered me, and when I refresh it, this time
around, my password is encrypted.
That one character, number one, has become this long string.
I mean, it's getting better. I would take that as a basic form of encryption
to store the password.
To make it more encrypted I would possibly go down the route of
putting in my email address beforehand and then the password
so that I can put those in place and what that will do is make that level of
security for it a little bit higher.
Now I will have to redo, don't control the D, part of my
login to make sure that it deals with that.
Because at the moment, if I go sign up a second and post that,
what I'm actually going to do is just very quickly take this value here, copy it
into notepad
and paste it. Remember, that is equal to the number one.
I'm going to delete this user
and recreate him a third time.
So let's go account. I'm going to go register.
Again, just using the number one as my password.
I'm going to submit it. It's recreated that user again.
And if I refresh the page,
that is now the reference for number one
the main difference being with this if i go back
into here a second and just undo that hashing just so you can see why it's important
sorry i do want to keep the hashing i don't want the email part there so we know
that by doing this and not having the email in place it will hash it it will create
that password for me i'll leave the user there a second refresh it we know that the
number one was referenced like that i'm going to go back in let's go account i'm
going to register this time um i'm to register as um one
first name one one email one at one
dot com and again one and one and submit it
that's going to create that user for me and the password
because it hasn't had
any form of sort what it's called added to the front of it which is what I use the
username for the email address for the passwords are identical so even though the
password isn't stored in plain text as one it is relatively easy
to see what the same passwords are and again if you were registering
for a malicious service and you found that they were trying to find out people's
passwords it wouldn't be too difficult without some form of salting to
find out what those passwords are
now if i go back into here and i re-add in that hash element so i want to put
email dot before it so it uses the email as well as the password
that's perfectly fine my sign up is perfectly fine i can up that to that user there
but i do need to go into my sign in and where i
I now need to incorporate my element of hashing.
Because right now, the only user who could sign into my database is my
initial user with a password of password1234.
If I go like this, now the only users who can sign into my database after I push it,
as always, would be the two new users.
So even though CPD and Mr. J. Jones is there, If I go to account, I go CPD,
I go password 1234 and submit,
it's accepted that. Let me log out a second and make sure that
sign in is pushed.
There. Okay. So let's go in and go CPD
password1234
submit. It's now telling me they're incorrect details, which is what I'd expect.
So in that regard, I would have to re-register this user.
So I'm going to delete him a second.
I'm going to go in and register that user.
so i'm going to do me james jones email address cpd of mr j
jones password one two three
password one two three submit let's log me in and if we
look at the password for it it is now a much more secure password
if i go to my account page and i go cpd password
one two three four
no because I won't do three one two three and submit
it logs me in is admin is zero I just want to correct that so I
am admin is admin is one and actually when I load this page it's not updated
because I have to log out to log back in to see that change
and I said this one so
within this series then within this session we have created a login system which
allows our users to verify they exist and we've also created a system that will
allow us to register new users as users with secure encrypted
passwords the only thing we haven't done is the forgot password which obviously can
be quite important especially when you forget your password and we will come back to
that one. If I get a solution to it today, I will upload the solution later on this
evening. If not, I'll make sure it's in place by session number eight and it will be
part of session seven. It'll be an additional video put in the bottom there.
Thank you all for watching. Hopefully that makes sense.
I'm anticipating you may need to watch this one through a couple of times, pause it
and see how it's going along. Any problems, don't hesitate to get in contact.
Thank you.
Thank you.