How can PHP developers implement user authentication using a database instead of hardcoding passwords in the code?

Storing passwords in code is a security risk. PHP developers can implement user authentication using a database by securely storing hashed passwords and comparing them during login. This ensures passwords are not exposed in the code and provides a more secure authentication process. 

// Database connection
$pdo = new PDO('mysql:host=localhost;dbname=your_database', 'username', 'password');

// User authentication
$username = $_POST['username'];
$password = $_POST['password'];

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $username);
$stmt->execute();
$user = $stmt->fetch();

if ($user && password_verify($password, $user['password'])) {
    // Authentication successful
    echo "Login successful!";
} else {
    // Authentication failed
    echo "Invalid username or password.";
}

Keywords

PHP user authentication database password hashing security

Related Questions