Authorization and Authentication in PHP: Code Examples |…

Authorization and Authentication in PHP: From Basics to Security

Web application security starts with the correct implementation of authentication (verifying user identity) and authorization (checking user access rights). In PHP, these mechanisms can be implemented using built-in functions as well as specialized libraries. In this article, we will break down key concepts, write code examples, and review best security practices.

1. Basic Concepts: Authentication vs Authorization

Before writing code, it is important to clearly distinguish between the two terms:

Authentication — the process of verifying that a user is who they claim to be (usually via login and password).
Authorization — the process of determining which resources or actions an authenticated user has access to (e.g., the role "admin" or "user").

Errors in implementing either of these stages can lead to data leaks or unauthorized access.

2. Basic Authentication via Sessions (Native PHP)

The most common method is using sessions. PHP provides a built-in $_SESSION mechanism. Let's look at a simple example.

Step 1: Login Form (login.php)

<?phpsession_start();?><!DOCTYPE html><html><head>    <title>Login to Site</title></head><body>    <form method="POST" action="login.php">        <label>Username:</label>        <input type="text" name="username" required>        <label>Password:</label>        <input type="password" name="password" required>        <button type="submit" name="login">Login</button>    </form></body></html>

Step 2: Login Processing (same login.php)

<?phpsession_start();require_once 'db.php'; // database connection

if (isset($_POST['login'])) {    $username = trim($_POST['username']);    $password = $_POST['password'];

    // 1. Prepared statement to protect against SQL injection    $stmt = $pdo->prepare("SELECT id, password_hash FROM users WHERE username = ?");    $stmt->execute([$username]);    $user = $stmt->fetch();

    // 2. Password verification via password_verify    if ($user && password_verify($password, $user['password_hash'])) {        // Authentication successful        $_SESSION['user_id'] = $user['id'];        $_SESSION['logged_in'] = true;        header("Location: dashboard.php");        exit;    } else {        $error = "Invalid username or password";    }}?>

Step 3: Authorization Check on a Protected Page

<?phpsession_start();if (!isset($_SESSION['logged_in']) || $_SESSION['logged_in'] !== true) {    header("Location: login.php");    exit;}// Access grantedecho "Welcome, user #" . htmlspecialchars($_SESSION['user_id']);?>

3. Password Hashing: Never Store Passwords in Plain Text

PHP provides secure functions for working with passwords:

password_hash($password, PASSWORD_BCRYPT) — creates a hash with a salt automatically.
password_verify($password, $hash) — verifies a password against a hash.

User registration example:

<?php$password = "user123";$hash = password_hash($password, PASSWORD_BCRYPT);// Save $hash to the database$stmt = $pdo->prepare("INSERT INTO users (username, password_hash) VALUES (?, ?)");$stmt->execute([$username, $hash]);?>

Important: never use md5() or sha1() for passwords — they are outdated and easily cracked.