A Clean Auth Starter
for PHP Students
Learn real-world authentication patterns — registration, login, role-based dashboards, and secure password reset — all in plain PHP.
What You'll Learn
Secure Authentication
Password hashing with bcrypt, session management, CSRF protection, and session regeneration on login.
Role-Based Access
Admins and regular users see different dashboards. Middleware protects routes based on session role.
Email with PHPMailer
Password reset emails sent via SMTP with expiring tokens. Safer and more deliverable than PHP's mail().
PDO & Prepared Statements
Every database query uses PDO prepared statements to prevent SQL injection attacks.
Environment Variables
Secrets live in .env, not in code. Learn why this matters before you ever touch a production server.
Clean Architecture
Code separated into config, auth, dashboards, and includes. Easy to read, easy to extend.