What are common pitfalls to avoid when writing a MySQL-based login system in PHP?

One common pitfall to avoid when writing a MySQL-based login system in PHP is using plain text passwords. It is crucial to securely hash passwords before storing them in the database to prevent unauthorized access in case of a data breach. Utilizing PHP's password_hash() function along with password_verify() for validation is a recommended approach. 

// Hashing the password before storing it in the database
$password = password_hash($_POST['password'], PASSWORD_DEFAULT);

// Storing the hashed password in the database
$query = "INSERT INTO users (username, password) VALUES (?, ?)";
$stmt = $pdo->prepare($query);
$stmt->execute([$username, $password]);

// Validating the password during login
$query = "SELECT password FROM users WHERE username = ?";
$stmt = $pdo->prepare($query);
$stmt->execute([$username]);
$row = $stmt->fetch();

if ($row && password_verify($_POST['password'], $row['password'])) {
    // Password is correct
} else {
    // Password is incorrect
}

Keywords

MySQL login system PHP security vulnerabilities SQL injection

Related Questions