Lab: User Registration System (Part 1)

Resources

Overview

In this lab, you’ll implement a secure user registration system that allows users to create accounts. You’ll build the database schema, a UserModel for data operations, validation logic, and a registration form with proper security measures including password hashing.

Part 2 (Authentication & Authorization) covers login, sessions, middleware, and role-based access control.

Learning Objectives

Create a user database table with proper schema design
Build a UserModel with CRUD operations
Implement secure password hashing using password_hash()
Validate user input (required fields, email format, uniqueness, password strength)
Create registration forms with proper HTML structure
Build an AuthController extending BaseController
Apply the Result pattern for validation feedback
Prevent common security vulnerabilities (SQL injection, XSS)

Prerequisites

Working Slim 4 application with BaseController pattern
Flash Messages lab completed (FlashMessage helper)
MySQL database connection using PDOService
BaseModel class available
Bootstrap CSS included in views
Access to phpMyAdmin for database management

Step 1: Create the Users Database Table

Objective: Set up the database schema for storing user accounts.

Instructions:

Open phpMyAdmin in your browser
Select your project database
Click on the “SQL” tab
Execute the following SQL statement:

CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    first_name VARCHAR(100) NOT NULL,
    last_name VARCHAR(100) NOT NULL,
    username VARCHAR(50) UNIQUE NOT NULL,
    email VARCHAR(100) UNIQUE NOT NULL,
    password_hash VARCHAR(255) NOT NULL,
    role ENUM('admin', 'customer') DEFAULT 'customer',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
);

Click “Go” to execute the query
Verify the table was created by clicking on the “Structure” tab or run: DESCRIBE users;

Key Points:

UNIQUE constraints on email and username prevent duplicates
VARCHAR(255) for password_hash handles bcrypt/Argon2
ENUM restricts role values to ‘admin’ or ‘customer’

Step 2: Create the UserModel Class

Step 2.1: Class Structure

Create a UserModel class in the app/Domain/Models/ directory. This model will handle all database operations related to users.

Step 2.2: Implement `createUser()` Method

Objective: Insert a new user with hashed password.

Why hash passwords? Never store plain text! If your database is compromised, hashed passwords protect users. Use password_hash() with bcrypt.

1
/**
2
 * Create a new user account.
3
 *
4
 * @param array $data User data (first_name, last_name, username, email, password, role)
5
 * @return int The ID of the newly created user
6
 */
7
public function createUser(array $data): int
8
{
9
    // TODO: Hash the password using password_hash() with PASSWORD_BCRYPT
10
    //       Store the result in $hashedPassword variable
11

12
    // TODO: Write an INSERT SQL query to insert a new user into the users table
13
    //       Insert: first_name, last_name, username, email, password_hash, role
14
    //       Use named parameters (e.g., :first_name, :last_name, etc.)
15

16
    // TODO: Execute the query with appropriate parameters
17
    //       Use $hashedPassword for the password_hash field
18

19
    // TODO: Return the last inserted ID
20
}

Hints:

password_hash($password, PASSWORD_BCRYPT) creates secure hash
Use named parameters in SQL for security
$this->execute() inherited from BaseModel
$this->lastInsertId() returns auto-increment ID

Step 2.3: Implement `findByEmail()` Method

Objective: Find a user by email address.

1
/**
2
 * Find a user by email address.
3
 *
4
 * @param string $email The email address to search for
5
 * @return array|null User data array or null if not found
6
 */
7
public function findByEmail(string $email): ?array
8
{
9
    // TODO: Write a SELECT SQL query to find a user by email
10
    //       Select all columns from the users table where email matches
11
    //       Use named parameter :email and LIMIT 1
12

13
    // TODO: Execute the query and return the result
14
}

Hints:

Use LIMIT 1 for efficiency
$this->selectOne() returns array or null

Step 2.4: Implement `findByUsername()` Method

1
/**
2
 * Find a user by username.
3
 *
4
 * @param string $username The username to search for
5
 * @return array|null User data array or null if not found
6
 */
7
public function findByUsername(string $username): ?array
8
{
9
    // TODO: Write a SELECT SQL query to find a user by username
10
    //       Select all columns from the users table where username matches
11
    //       Use named parameter :username and LIMIT 1
12

13
    // TODO: Execute the query and return the result
14
}

Step 2.5: Implement Existence Check Methods

Objective: Check if email/username exists for validation during registration.

1
/**
2
 * Check if an email address already exists in the database.
3
 *
4
 * @param string $email The email address to check
5
 * @return bool True if email exists, false otherwise
6
 */
7
public function emailExists(string $email): bool
8
{
9
    // TODO: Write a SELECT COUNT(*) query to count users with the given email
10
    //       Alias the count as 'count'
11
    //       Use named parameter :email
12

13
    // TODO: Execute the query and return true if count > 0, false otherwise
14
}
15

16
/**
17
 * Check if a username already exists in the database.
18
 *
19
 * @param string $username The username to check
20
 * @return bool True if username exists, false otherwise
21
 */
22
public function usernameExists(string $username): bool
23
{
24
    // TODO: Write a SELECT COUNT(*) query to count users with the given username
25
    //       Alias the count as 'count'
26
    //       Use named parameter :username
27

28
    // TODO: Execute the query and return true if count > 0, false otherwise
29
}

Step 3: Create the Registration Form View

Objective: Create an HTML form for user registration.

Create app/Views/auth/register.php:

1
<!DOCTYPE html>
2
<html lang="en">
3
<head>
4
    <meta charset="UTF-8">
5
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
    <title>Register - Authentication System</title>
7
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
8
</head>
9
<body>
10
    <div class="container mt-5">
11
        <div class="row justify-content-center">
12
            <div class="col-md-6">
13
                <div class="card">
14
                    <div class="card-header">
15
                        <h3 class="text-center">Create Account</h3>
16
                    </div>
17
                    <div class="card-body">
18
                        <?= App\Helpers\FlashMessage::render() ?>
19

20
                        <form method="POST" action="register">
21
                            <div class="mb-3">
22
                                <label for="first_name" class="form-label">First Name</label>
23
                                <input type="text" class="form-control" id="first_name" name="first_name" required>
24
                            </div>
25

26
                            <div class="mb-3">
27
                                <label for="last_name" class="form-label">Last Name</label>
28
                                <input type="text" class="form-control" id="last_name" name="last_name" required>
29
                            </div>
30

31
                            <div class="mb-3">
32
                                <label for="username" class="form-label">Username</label>
33
                                <input type="text" class="form-control" id="username" name="username" required>
34
                            </div>
35

36
                            <div class="mb-3">
37
                                <label for="email" class="form-label">Email Address</label>
38
                                <input type="email" class="form-control" id="email" name="email" required>
39
                            </div>
40

41
                            <div class="mb-3">
42
                                <label for="password" class="form-label">Password</label>
43
                                <input type="password" class="form-control" id="password" name="password" required>
44
                                <div class="form-text">
45
                                    Password must be at least 8 characters long and contain at least one number.
46
                                </div>
47
                            </div>
48

49
                            <div class="mb-3">
50
                                <label for="confirm_password" class="form-label">Confirm Password</label>
51
                                <input type="password" class="form-control" id="confirm_password" name="confirm_password" required>
52
                            </div>
53

54
                            <input type="hidden" name="role" value="customer">
55

56
                            <div class="d-grid gap-2">
57
                                <button type="submit" class="btn btn-primary">Register</button>
58
                            </div>
59
                        </form>
60

61
                        <div class="mt-3 text-center">
62
                            <p>Already have an account? <a href="login">Login here</a></p>
63
                        </div>
64
                    </div>
65
                </div>
66
            </div>
67
        </div>
68
    </div>
69

70
    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
71
</body>
72
</html>

Step 4: Create AuthController with Registration Logic

Objective: Handle registration requests with validation.

Create app/Controllers/AuthController.php:

1
<?php
2

3
namespace App\Controllers;
4

5
use App\Domain\Models\UserModel;
6
use App\Helpers\FlashMessage;
7
use App\Helpers\SessionManager;
8
use DI\Container;
9
use Psr\Http\Message\ResponseInterface as Response;
10
use Psr\Http\Message\ServerRequestInterface as Request;
11

12
class AuthController extends BaseController
13
{
14
    public function __construct(Container $container, private UserModel $userModel)
15
    {
16
        parent::__construct($container);
17
    }
18

19
    /**
20
     * Display the registration form (GET request).
21
     */
22
    public function register(Request $request, Response $response, array $args): Response
23
    {
24
        // TODO: Create a $data array with 'title' => 'Register'
25

26
        // TODO: Render 'auth/register.php' view and pass $data
27
    }
28

29
    /**
30
     * Process registration form submission (POST request).
31
     */
32
    public function store(Request $request, Response $response, array $args): Response
33
    {
34
        // TODO: Get form data using getParsedBody()
35
        //       Store in $formData variable
36

37
        // TODO: Extract individual fields from $formData:
38
        //       $firstName, $lastName, $username, $email, $password, $confirmPassword, $role
39

40
        // Start validation
41
        $errors = [];
42

43
        // TODO: Validate required fields (first_name, last_name, username, email, password, confirm_password)
44
        //       If any field is empty, add error: "All fields are required."
45
        //       Hint: if (empty($firstName) || empty($lastName) || ...) { $errors[] = "..."; }
46

47
        // TODO: Validate email format using filter_var()
48
        //       If invalid, add error: "Invalid email format."
49
        //       Hint: if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { ... }
50

51
        // TODO: Check if email already exists using $this->userModel->emailExists($email)
52
        //       If exists, add error: "Email already registered."
53

54
        // TODO: Check if username already exists using $this->userModel->usernameExists($username)
55
        //       If exists, add error: "Username already taken."
56

57
        // TODO: Validate password length (minimum 8 characters)
58
        //       If too short, add error: "Password must be at least 8 characters long."
59

60
        // TODO: Validate password contains at least one number
61
        //       If no number, add error: "Password must contain at least one number."
62
        //       Hint: if (!preg_match('/[0-9]/', $password)) { ... }
63

64
        // TODO: Check if password matches confirm_password
65
        //       If not match, add error: "Passwords do not match."
66

67
        // If validation errors exist, redirect back with error message
68
        // TODO: Check if $errors array is not empty
69
        //       If errors exist:
70
        //         - Use FlashMessage::error() with the first error message
71
        //         - Redirect back to 'auth.register' route
72

73
        // If validation passes, create the user
74
        try {
75
            // TODO: Create $userData array with keys:
76
            //       'first_name', 'last_name', 'username', 'email', 'password', 'role'
77

78
            // TODO: Call $this->userModel->createUser($userData)
79
            //       Store the returned user ID in $userId
80

81
            // TODO: Display success message using FlashMessage::success()
82
            //       Message: "Registration successful! Please log in."
83

84
            // TODO: Redirect to 'auth.login' route
85

86
        } catch (\Exception $e) {
87
            // TODO: Display error message using FlashMessage::error()
88
            //       Message: "Registration failed. Please try again."
89

90
            // TODO: Redirect back to 'auth.register' route
91
        }
92
    }
93
}

Step 5: Register Routes

Open app/Routes/web-routes.php and add:

1
use App\Controllers\AuthController;
2

3
// TODO: Create a GET route for '/register' that maps to AuthController::class 'register' method
4
//       Set the route name to 'auth.register'
5

6
// TODO: Create a POST route for '/register' that maps to AuthController::class 'store' method

Testing Your Implementation

Test Case 1: Valid Registration

Visit http://localhost/[your-app]/register
Fill in all fields with valid data:
- First Name: John
- Last Name: Doe
- Username: johndoe
- Email: john@example.com
- Password: password123
- Confirm Password: password123
Click “Register”
Expected: Green success message and redirect to login page

Test Case 2: Validation Errors

Test each validation rule:

a) Empty fields:

Leave one or more fields empty
Expected: “All fields are required.”

b) Invalid email format:

Enter invalid email (e.g., “notanemail”)
Expected: “Invalid email format.”

c) Duplicate email:

Register with the same email again
Expected: “Email already registered.”

d) Duplicate username:

Register with the same username again
Expected: “Username already taken.”

e) Weak password:

Enter password with less than 8 characters
Expected: “Password must be at least 8 characters long.”

f) Password without number:

Enter password without numbers (e.g., “password”)
Expected: “Password must contain at least one number.”

g) Password mismatch:

Enter different values for password and confirm password
Expected: “Passwords do not match.”

Test Case 3: Password Hashing Verification

Register a new user with password “test123”
Open phpMyAdmin and navigate to your e-commerce database
Click on the users table and view the “Browse” tab
Check the password_hash column for the newly registered user
Expected: Long hashed string starting with $2y$ (bcrypt), NOT “test123”

Test Your Understanding

Why must passwords be hashed instead of stored as plain text in the database?
Why does password_hash() generate a different hash each time for the same password?
What is the difference between authentication and authorization? Give an example of each.
Why do we use prepared statements with named parameters instead of concatenating user input into SQL queries?
What would happen if you removed the UNIQUE constraint from the email column?
Why do we validate email format AND check for email uniqueness (two separate checks)?
What security vulnerability exists if you don’t validate user input on the server side?
Why is VARCHAR(255) recommended for password_hash columns even though bcrypt only needs 60 characters?
What is the purpose of the Post-Redirect-Get (PRG) pattern used in the store() method?
Why do we check if the email exists separately from checking if the username exists?

Next Steps

Continue to Part 2: Login & Authentication to implement:

User login with password verification
Session management
Route protection with middleware
Role-based access control (admin vs customer)
Dashboard views