AUZ Tutorials · Free source code

Secure Login & Registration in PHP + MySQL (2026)

The complete, working code from the video: a login and registration system in modern plain PHP, with no framework, protected against SQL injection, XSS, CSRF, session hijacking and brute-force attacks.

Download
PHP 8.2+MySQL / MariaDBXAMPP · LaragonMIT License~19 KB
Download source code (.zip)

What's inside

✓
Password hashingpassword_hash() with bcrypt, auto-upgraded by password_needs_rehash()
✓
No SQL injectionPDO prepared statements everywhere, real (not emulated) prepares
✓
CSRF protectionSecret token on every form, checked with hash_equals()
✓
No XSSAll output escaped with a tiny e() helper
✓
Secure session cookieHttpOnly, SameSite=Lax, Secure on HTTPS, strict mode
✓
No session fixationsession_regenerate_id() right after login
✓
Login rate limiting5 failed attempts per email + IP locks login for 15 minutes
✓
Safe logoutPOST + CSRF token, session fully destroyed
✓
No leaked errorsVisitors never see file paths or database details (DEBUG switch)

Run it on XAMPP

  1. Unzip and copy the auth-2026 folder into C:\xampp\htdocs\
  2. Open the XAMPP Control Panel and click Start next to Apache and MySQL
  3. Open http://localhost/phpmyadmin, click New and create a database named auth_2026 (collation utf8mb4_unicode_ci)
  4. With auth_2026 selected, open the Import tab, choose database/schema.sql and click Import
  5. Visit http://localhost/auth-2026/public/ and create your first account

Seeing Unknown database 'auth_2026'? You skipped step 3: create the database first, then import. Using Laragon? Put the folder in C:\laragon\www\ and visit http://auth-2026.test/public/.

Before you go live

⚠ Production checklist

  • In src/bootstrap.php set const DEBUG = false; so visitors only see a plain error message
  • Use HTTPS (the session cookie becomes Secure automatically)
  • Create a dedicated MySQL user with a strong password instead of root, and update config.php
  • Point your domain's document root at the public/ folder

Project structure

auth-2026/
├── config.php          settings (DB login, rate limit)
├── database/schema.sql tables
├── public/             the only folder the browser can reach
│   ├── index.php  register.php  login.php  dashboard.php  logout.php
│   └── assets/style.css
└── src/                app code, not reachable from the browser
    ├── bootstrap.php   session, headers, error handler, loads everything
    ├── db.php          config() and db() (PDO)
    ├── helpers.php     e(), input(), old(), redirect(), flash()
    ├── csrf.php        csrf_token(), csrf_field(), csrf_verify()
    ├── auth.php        current_user(), login/logout, rate limiting
    └── views/          header.php, footer.php

Need a secure login or a custom web app for your business?

AUZ Dynamics builds fast, secure WordPress and custom PHP websites for clients across North America.

Start a project Subscribe on YouTube Watch on YouTube

Free to use under the MIT License · Made by AUZ Dynamics · Tutorial by AUZ Tutorials