Member Avatar for curtranhome

can anyone please give me the code (or point me in the right direction) to be able to password protect a web page with javascript that gets the usernames and passwords from a database and displays a message if the entered password or username is wrong and points the user to a page if it is correct. and i also want it to create a cookie so that the user doesn't have to put in his/her password all the time.
can anyone help me out please!

  • 2 Contributors
  • 1 Reply
  • 98 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by stephen84s

Dani AI

Generated

asked for a JS-based login that reads usernames/passwords from a database and remembers users with a cookie. correctly flagged that you need server-side logic. Below is a compact, practical pattern (PHP + database) that is secure enough for production use and matches the behaviors you described: validate against a DB, show failure/success feedback, and remember users without storing passwords in cookies.

Use these building blocks:

  • Store only hashed passwords (use password_hash() when creating accounts and password_verify() when checking). See password_hash() docs.
  • Authenticate on the server with prepared statements (PDO) to avoid SQL injection. See PDO prepared statements.
  • Use PHP sessions for the active login and a separate long random token for "remember me". Generate the token with random_bytes(), store only a hashed version in the DB, and set the raw token in an HttpOnly, Secure cookie.
  • On each visit, if there is no session but the cookie exists, look up the hashed token and expiry; if valid, start a session and rotate the token (invalidate old token, issue a new one).

Minimal PHP snippets (illustrative):

$stmt = $pdo->prepare('SELECT id, password FROM users WHERE username = :u');
$stmt->execute([':u'=>$username]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);
if ($user && password_verify($password, $user['password'])) {
  session_start();
  session_regenerate_id(true);
  $_SESSION['uid'] = $user['id'];
  // optionally create a remember token below
}
$token = bin2hex(random_bytes(32));
$hash = hash('sha256', $token);
$expires = time()+30*24*60*60;
$pdo->prepare('INSERT INTO auth_tokens (user_id, token_hash, expires) VALUES (?,?,?)')
    ->execute([$userId, $hash, date('Y-m-d H:i:s', $expires)]);
setcookie('remember', $token, ['expires'=>$expires, 'path'=>'/', 'secure'=>true, 'httponly'=>true, 'samesite'=>'Lax']);

Security notes: always use HTTPS for Secure cookies, never store plaintext passwords or raw tokens in the DB, rotate tokens on reuse, and expire them server-side. For a checklist and best practices see the OWASP Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html.

Member Avatar for stephen84s

can anyone please give me the code (or point me in the right direction) to be able to password protect a web page with javascript that gets the usernames and passwords from a database and displays a message if the entered password or username is wrong and points the user to a page if it is correct. and i also want it to create a cookie so that the user doesn't have to put in his/her password all the time.
can anyone help me out please!

You can't do that with pure Javascript, you need some server side script to work with you for that

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.