Building a Secure PHP MySQL Signup/Login Website with Email Verification

<?php
require_once 'db_connect.php';

require_once("PHPMailer-master/src/PHPMailer.php");
require_once("PHPMailer-master/src/SMTP.php");
require_once("PHPMailer-master/src/Exception.php");

use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = $_POST["username"];
    $email = $_POST["email"];
    $password = password_hash($_POST["password"], PASSWORD_DEFAULT);
    $verificationCode = bin2hex(random_bytes(16));

    $stmt = $conn->prepare("INSERT INTO users (username, email, password, verification_code) VALUES (?, ?, ?, ?)");
    
    if (!$stmt) {
        die("Error in statement preparation: " . $conn->error);
    }

    $stmt->bind_param("ssss", $username, $email, $password, $verificationCode);

    if ($stmt->execute()) {
        $verificationLink = "http://localhost/secure_login/verify.php?code=$verificationCode";
        
        // Send verification email using Gmail
        $mail = new PHPMailer(true);
        try {

            $mail->SMTPOptions = array(
                'ssl' => array(
                    'verify_peer' => false,
                    'verify_peer_name' => false,
                    'allow_self_signed' => true,
                ),
            );
            
            $mail->isSMTP();
            $mail->Host       = 'smtp.gmail.com';
            $mail->SMTPAuth   = true;
            $mail->Username   = 'your gamil address';
            $mail->Password   = 'your App Password'; // Replace with your App Password
            $mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS; // or ENCRYPTION_SSL
            $mail->Port       = 587; // or 465 for SSL

            $mail->setFrom('your gamil address', 'Kisorjan');
            $mail->addAddress($email);

            $mail->isHTML(true);
            $mail->Subject = 'Email Verification';
            $mail->Body    = "Click the link below to verify your email: <a href='$verificationLink'>$verificationLink</a>";

            $mail->send();
            echo "Registration successful. Please check your email for verification.";
        } catch (Exception $e) {
            echo "Error sending verification email: {$mail->ErrorInfo}";
        }
    } else {
        echo "Error in registration: " . $stmt->error;
    }

    $stmt->close();
    $conn->close();
}
?>

Please replace placeholder values like [email protected] and your_gmail_password with your actual Gmail credentials. Additionally, consider enabling "Less secure app access" in your Gmail account settings for this to work.

Before May 30, 2022, from your Google account security settings “Less secure app access” had to be turned on to send emails using PHPMailer. Since the “Less secure apps” feature that allows third-party software and devices to sign in to your Gmail account is no longer supported by Google you can choose the other more secure options available.

2-Step Verification

If 2-step verification is enabled for your Gmail account and you wish to use it with PHPMailer as well, you will need to create an App password to continue by following these Google instructions. It is a 16-digit passcode, which you should put as a value to $mail->Password.

Remember, using real email and password in code is not recommended for production applications. Instead, use environment variables or configuration files to store sensitive information securely.

Step 7. Email Verification Script (verify.php)

Create a PHP script (verify.php) to handle email verification:

<?php
require_once 'db_connect.php';

if (isset($_GET["code"])) {
    $verificationCode = $_GET["code"];

    $stmt = $conn->prepare("UPDATE users SET is_verified = 1 WHERE verification_code = ?");

    if (!$stmt) {
        die("Error in statement preparation: " . $conn->error);
    }

    $stmt->bind_param("s", $verificationCode);

    if ($stmt->execute()) {
        echo "Email verified successfully. You can now login.";
    } else {
        echo "Error in email verification: " . $stmt->error;
    }

    $stmt->close();
    $conn->close();
} else {
    echo "Invalid verification code.";
}
?>

Step 8. PHP Login Script (login.php)

Create a PHP script (login.php) to handle user login:

<?php
session_start();
require_once 'db_connect.php';

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $email = $_POST["email"];
    $password = $_POST["password"];

    $stmt = $conn->prepare("SELECT id, username, password, is_verified FROM users WHERE email = ?");
    $stmt->bind_param("s", $email);
    $stmt->execute();
    $stmt->bind_result($id, $username, $hashedPassword, $isVerified);
    $stmt->fetch();
    $stmt->close();

    if ($isVerified && password_verify($password, $hashedPassword)) {
        $_SESSION['user_id'] = $id;
        $_SESSION['username'] = $username;
        header("Location: dashboard.php");
        exit();
    } else {
        echo "Invalid login credentials or unverified account.";
    }

    $conn->close();
}
?>

Step 9. Create a Dashboard (dashboard.php)

Create a simple dashboard page (dashboard.php) that only authenticated users can access:

<?php
session_start();
if (!isset($_SESSION['user_id'])) {
    header("Location: index.php");
    exit();
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Dashboard</title>
</head>
<body>
    <!-- Dashboard content goes here -->
</body>
</html>

Conclusion

By following these steps, you've created a PHP MySQL login/signup website with email verification, incorporating secure password encryption practices. Always stay informed about the latest security best practices, and consider additional measures such as HTTPS, session management, and input validation to enhance the security of your web application.

Please note that this is a simplified example, and for a production-level system, you should implement additional security measures, and error handling, and consider using a framework that provides built-in security features.

If you have any questions, please enter them in the comment box.