Here's a quick way to secure a page so only logged in users can access it otherwise the user is shown a login page.

This system will be using sessions and using headers to redirect the user. Enable sessions and output buffering at the top of the file.

Username: demo
Password: demopassword

session_start();
ob_start();

To log a user out destroy the session and refresh the page.

if(isset($_GET['logout'])){
    session_destroy();
    header('Location: '.$_SERVER['PHP_SELF']);
    exit;    
}

To show the page contents to logged in users a check is made against the session if authorised is set then show the contents.

if(isset($_SESSION['authorised'])){

Otherwise show a login form.

<fieldset>
    <legend>Login</legend>
    <form action='' method='post'>
        <p>Username: <input type='text' name='username' value=''></p>
        <p>Username: <input type='password' name='password' value=''></p>
        <p><input type='submit' name='loginsubmit' value='Login'></p>
    </form>
</fieldset>

If the form has been submitted then capture the username and password from the form check against a defined username and password if they match create the session and refresh the page otherwise create an error message and save it to a variable called $error.

if(isset($_POST['loginsubmit'])){

    $username = $_POST['username'];
    $password = $_POST['password'];

    if($username == 'demo' && $password == 'demopassword'){
        //correct username and password
        $_SESSION['authorised'] = true;
        header('Location: '.$_SERVER['PHP_SELF']);
        exit;
    } else {
        $error = '<p style="color:#ff0000;">Sorry wrong username or password</p><p>Please try again</p>';
    }
}

If the error has been created then show it.

<?php if(isset($error)){ echo $error; }?>

At the bottom of the file clear the buffer by calling ob_flush();

Putting in all together:

<?php
session_start();
ob_start();

if(isset($_GET['logout'])){
    session_destroy();
    header('Location: '.$_SERVER['PHP_SELF']);
    exit;    
}

?>

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Member Only Page</title>

</head>
<body>

<?php

//already logged in
if(isset($_SESSION['authorised'])){
?>

    <h1>Member Only Page<h1>
    <p>This page can only be seen when logged in.</p>
    <p><a href="?logout">Logout</a></p>


<?php 
} else { //user needs to login

    if(isset($_POST['loginsubmit'])){

        $username = $_POST['username'];
        $password = $_POST['password'];

        if($username == 'demo' && $password == 'demopassword'){
            //correct username and password
            $_SESSION['authorised'] = true;
            header('Location: '.$_SERVER['PHP_SELF']);
            exit;
        } else {
            $error = '<p style="color:#ff0000;">Sorry wrong username or password</p><p>Please try again</p>';
        }
    }

    ?>

    <div style='margin:auto; width:300px; margin-top:20px;'>
        
        <?php if(isset($error)){ echo $error; }?>

        <fieldset>
            <legend>Login</legend>
            <form action='' method='post'>
                <p>Username: <input type='text' name='username' value=''></p>
                <p>Username: <input type='password' name='password' value=''></p>
                <p><input type='submit' name='loginsubmit' value='Login'></p>
            </form>
        </fieldset>
        

    </div>

<?php } ?> 
</body>
</html>
<?php ob_flush(); ?>

Simple Member Only Page

Table of Contents

Putting in all together: