aboutsummaryrefslogtreecommitdiff
path: root/content/blog/2020-08-29-php-auth-flow.md
diff options
context:
space:
mode:
authorChristian Cleberg <hello@cleberg.net>2024-04-29 14:18:55 -0500
committerChristian Cleberg <hello@cleberg.net>2024-04-29 14:18:55 -0500
commitfdd80eadcc2f147d0198d94b7b908764778184a2 (patch)
treefbec9522ea9aa13e8105efc413d2498c3c5b4cd6 /content/blog/2020-08-29-php-auth-flow.md
parentd6c80fdc1dea9ff242a4d3c7d3939d2727a8da56 (diff)
downloadcleberg.net-fdd80eadcc2f147d0198d94b7b908764778184a2.tar.gz
cleberg.net-fdd80eadcc2f147d0198d94b7b908764778184a2.tar.bz2
cleberg.net-fdd80eadcc2f147d0198d94b7b908764778184a2.zip
format line wrapping and fix escaped characters
Diffstat (limited to 'content/blog/2020-08-29-php-auth-flow.md')
-rw-r--r--content/blog/2020-08-29-php-auth-flow.md80
1 files changed, 38 insertions, 42 deletions
diff --git a/content/blog/2020-08-29-php-auth-flow.md b/content/blog/2020-08-29-php-auth-flow.md
index 499eada..fcc9e02 100644
--- a/content/blog/2020-08-29-php-auth-flow.md
+++ b/content/blog/2020-08-29-php-auth-flow.md
@@ -7,16 +7,15 @@ draft = false
# Introduction
-When creating websites that will allow users to create accounts, the
-developer always needs to consider the proper authentication flow for
-their app. For example, some developers will utilize an API for
-authentication, some will use OAuth, and some may just use their own
-simple database.
+When creating websites that will allow users to create accounts, the developer
+always needs to consider the proper authentication flow for their app. For
+example, some developers will utilize an API for authentication, some will use
+OAuth, and some may just use their own simple database.
-For those using pre-built libraries, authentication may simply be a
-problem of copying and pasting the code from their library\'s
-documentation. For example, here\'s the code I use to authenticate users
-with the Tumblr OAuth API for my Tumblr client, Vox Populi:
+For those using pre-built libraries, authentication may simply be a problem of
+copying and pasting the code from their library's documentation. For example,
+here's the code I use to authenticate users with the Tumblr OAuth API for my
+Tumblr client, Vox Populi:
``` php
// Start the session
@@ -41,24 +40,23 @@ $client = new Tumblr\API\Client(
);
```
-However, developers creating authentication flows from scratch will need
-to think carefully about when to make sure a web page will check the
-user\'s authenticity.
+However, developers creating authentication flows from scratch will need to
+think carefully about when to make sure a web page will check the user's
+authenticity.
-In this article, we\'re going to look at a simple authentication flow
-using a MySQL database and PHP.
+In this article, we're going to look at a simple authentication flow using a
+MySQL database and PHP.
# Creating User Accounts
-The beginning to any type of user authentication is to create a user
-account. This process can take many formats, but the simplest is to
-accept user input from a form (e.g., username and password) and send it
-over to your database. For example, here\'s a snippet that shows how to
-get username and password parameters that would come when a user submits
-a form to your PHP script.
+The beginning to any type of user authentication is to create a user account.
+This process can take many formats, but the simplest is to accept user input
+from a form (e.g., username and password) and send it over to your database. For
+example, here's a snippet that shows how to get username and password
+parameters that would come when a user submits a form to your PHP script.
-**Note**: Ensure that your password column is large enough to hold the
-hashed value (at least 60 characters or longer).
+**Note**: Ensure that your password column is large enough to hold the hashed
+value (at least 60 characters or longer).
``` php
// Get the values from the URL
@@ -97,9 +95,9 @@ $conn->close();
## Validate Returning Users
-To be able to verify that a returning user has a valid username and
-password in your database is as simple as having users fill out a form
-and comparing their inputs to your database.
+To be able to verify that a returning user has a valid username and password in
+your database is as simple as having users fill out a form and comparing their
+inputs to your database.
``` php
// Query the database for username and password
@@ -116,24 +114,23 @@ if(password_verify($password_input, $hashed_password)) {
# Storing Authentication State
-Once you\'ve created the user\'s account, now you\'re ready to
-initialize the user\'s session. **You will need to do this on every page
-you load while the user is logged in.\*** To do so, simply enter the
-following code snippet:
+Once you've created the user's account, now you're ready to initialize the
+user's session. **You will need to do this on every page you load while the
+user is logged in.** To do so, simply enter the following code snippet:
``` php
session_start();
```
-Once you\'ve initialized the session, the next step is to store the
-session in a cookie so that you can access it later.
+Once you've initialized the session, the next step is to store the session in a
+cookie so that you can access it later.
``` php
setcookie(session_name());
```
-Now that the session name has been stored, you\'ll be able to check if
-there\'s an active session whenever you load a page.
+Now that the session name has been stored, you'll be able to check if there's
+an active session whenever you load a page.
``` php
if(isset(session_name())) {
@@ -143,9 +140,9 @@ if(isset(session_name())) {
## Removing User Authentication
-The next logical step is to give your users the option to log out once
-they are done using your application. This can be tricky in PHP since a
-few of the standard ways do not always work.
+The next logical step is to give your users the option to log out once they are
+done using your application. This can be tricky in PHP since a few of the
+standard ways do not always work.
``` php
// Initialize the session.
@@ -183,14 +180,13 @@ die();
# Wrapping Up
-Now you should be ready to begin your authentication programming with
-PHP. You can create user accounts, create sessions for users across
-different pages of your site, and then destroy the user data when
-they\'re ready to leave.
+Now you should be ready to begin your authentication programming with PHP. You
+can create user accounts, create sessions for users across different pages of
+your site, and then destroy the user data when they're ready to leave.
For more information on this subject, I recommend reading the [PHP
-Documentation](https://www.php.net/). Specifically, you may want to look
-at [HTTP Authentication with
+Documentation](https://www.php.net/). Specifically, you may want to look at
+[HTTP Authentication with
PHP](https://www.php.net/manual/en/features.http-auth.php), [session
handling](https://www.php.net/manual/en/book.session.php), and
[hash](https://www.php.net/manual/en/function.hash.php).