Authorization and Authentication in PHP: A Complete Guide with Examples

Authorization and Authentication in PHP: How to Secure Your Website

Security is one of the key aspects of any web application. In PHP, authentication (verifying user identity) and authorization (determining access rights) are implemented using built-in tools: sessions, cookies, password hashing, and database operations. In this article, we will cover the complete cycle of creating a login, registration, and access control system in PHP.

1. Basic Concepts

• Authentication — the process of verifying whether a user is who they claim to be (usually by login and password).
• Authorization — checking whether an authenticated user has the right to perform a specific action (e.g., accessing the admin panel).
• Session — a temporary data storage on the server associated with a specific visitor via a unique identifier (session ID).
• Password Hashing — converting a password into an irreversible string for secure storage in the database.

2. User Registration

The first step is creating a registration form and handler. The password is never stored in plain text — we use the password_hash() function.

2.1. Registration Form (register.php)

<form method="post" action="register_handler.php">    <input type="text" name="username" placeholder="Username" required>    <input type="email" name="email" placeholder="Email" required>    <input type="password" name="password" placeholder="Password" required>    <button type="submit">Register</button></form>

2.2. Registration Handler (register_handler.php)

<?php// Database connection (PDO)$pdo = new PDO('mysql:host=localhost;dbname=test', 'root', '');

$username = $_POST['username'];$email = $_POST['email'];$password = password_hash($_POST['password'], PASSWORD_BCRYPT); // hash it

$stmt = $pdo->prepare("INSERT INTO users (username, email, password) VALUES (?, ?, ?)");$stmt->execute([$username, $email, $password]);

header('Location: login.php');?>

Use PASSWORD_BCRYPT — it automatically generates a salt and is considered sufficiently secure.

3. Authentication (Login)

When logging in, we compare the entered password with the hash from the database using password_verify() and create a session.

3.1. Login Form (login.php)

<form method="post" action="login_handler.php">    <input type="text" name="username" placeholder="Username" required>    <input type="password" name="password" placeholder="Password" required>    <button type="submit">Log In</button></form>

3.2. Login Handler (login_handler.php)

<?phpsession_start();$pdo = new PDO('mysql:host=localhost;dbname=test', 'root', '');

$username = $_POST['username'];$password = $_POST['password'];

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");$stmt->execute([$username]);$user = $stmt->fetch();

if ($user && password_verify($password, $user['password'])) {    // Authentication successful    $_SESSION['user_id'] = $user['id'];    $_SESSION['username'] = $user['username'];    $_SESSION['role'] = $user['role']; // for authorization    header('Location: dashboard.php');} else {    echo "Invalid username or password";}?>

4. Authorization (Access Control)

After authentication, the user receives a role (e.g., 'user', 'admin', 'moderator'). Authorization checks this role before performing actions.

4.1. Simple Role Check

<?phpsession_start();

// Check if the user is authorized