Building a User Registration System with PHP, MYSQL

CREATE TABLE users (
    id            INT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    email         VARCHAR(255) NOT NULL,
    password_hash VARCHAR(255) NOT NULL,
    created_at    DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
    UNIQUE KEY uq_users_email (email)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

<?php
return [
    'db_dsn'  => 'mysql:host=localhost;dbname=youruser_app;charset=utf8mb4',
    'db_user' => 'youruser_appuser',
    'db_pass' => 'a-long-random-password',
];

<?php
declare(strict_types=1);

function db(): PDO
{
    static $pdo = null;
    if ($pdo === null) {
        $c = require __DIR__ . '/config.php';
        $pdo = new PDO($c['db_dsn'], $c['db_user'], $c['db_pass'], [
            PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
            PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
            PDO::ATTR_EMULATE_PREPARES   => false,
        ]);
    }
    return $pdo;
}

function e(string $v): string
{
    return htmlspecialchars($v, ENT_QUOTES, 'UTF-8');
}

<?php
declare(strict_types=1);
require '/home/youruser/app/db.php';
require '/home/youruser/app/csrf.php';
start_secure_session();

$errors = [];
$email  = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();

    $email    = trim((string) ($_POST['email'] ?? ''));
    $password = (string) ($_POST['password'] ?? '');

    if (!filter_var($email, FILTER_VALIDATE_EMAIL) || strlen($email) > 255) {
        $errors[] = 'Please enter a valid email address.';
    }
    if (strlen($password) < 12 || strlen($password) > 72) {
        $errors[] = 'Use a password between 12 and 72 characters.';
    }

    if (!$errors) {
        try {
            $stmt = db()->prepare('INSERT INTO users (email, password_hash) VALUES (?, ?)');
            $stmt->execute([strtolower($email), password_hash($password, PASSWORD_DEFAULT)]);
            header('Location: login.php?registered=1');
            exit;
        } catch (PDOException $ex) {
            if ($ex->errorInfo[1] === 1062) {          // duplicate email
                $errors[] = 'That email is already registered. Try logging in.';
            } else {
                error_log($ex->getMessage());
                $errors[] = 'Something went wrong. Please try again later.';
            }
        }
    }
}
?>
<h1>Create an account</h1>
<?php foreach ($errors as $err): ?><p class="error"><?= e($err) ?></p><?php endforeach; ?>
<form method="post">
    <?= csrf_field() ?>
    <label>Email <input type="email" name="email" value="<?= e($email) ?>" required></label>
    <label>Password <input type="password" name="password" minlength="12" maxlength="72" autocomplete="new-password" required></label>
    <button type="submit">Register</button>
</form>

<?php
declare(strict_types=1);
require '/home/youruser/app/db.php';
require '/home/youruser/app/csrf.php';
start_secure_session();

$error = '';
$email = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();

    $email    = strtolower(trim((string) ($_POST['email'] ?? '')));
    $password = (string) ($_POST['password'] ?? '');

    $stmt = db()->prepare('SELECT id, password_hash FROM users WHERE email = ?');
    $stmt->execute([$email]);
    $user = $stmt->fetch();

    if ($user && password_verify($password, $user['password_hash'])) {
        if (password_needs_rehash($user['password_hash'], PASSWORD_DEFAULT)) {
            db()->prepare('UPDATE users SET password_hash = ? WHERE id = ?')
                ->execute([password_hash($password, PASSWORD_DEFAULT), $user['id']]);
        }
        session_regenerate_id(true);
        unset($_SESSION['csrf_token']);
        $_SESSION['user_id'] = (int) $user['id'];
        header('Location: account.php');
        exit;
    }

    $error = 'Incorrect email or password.';
}
?>
<h1>Log in</h1>
<?php if (isset($_GET['registered'])): ?><p>Account created. Please log in.</p><?php endif; ?>
<?php if ($error): ?><p class="error"><?= e($error) ?></p><?php endif; ?>
<form method="post">
    <?= csrf_field() ?>
    <label>Email <input type="email" name="email" value="<?= e($email) ?>" required></label>
    <label>Password <input type="password" name="password" autocomplete="current-password" required></label>
    <button type="submit">Log in</button>
</form>

<?php
declare(strict_types=1);
require '/home/youruser/app/csrf.php';
start_secure_session();

if (empty($_SESSION['user_id'])) {
    header('Location: login.php');
    exit;
}
?>
<h1>Your account</h1>
<form method="post" action="logout.php">
    <?= csrf_field() ?>
    <button type="submit">Log out</button>
</form>

<?php
declare(strict_types=1);
require '/home/youruser/app/csrf.php';
start_secure_session();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    exit;
}
csrf_verify();

$_SESSION = [];
$p = session_get_cookie_params();
setcookie(session_name(), '', [
    'expires'  => time() - 3600,
    'path'     => $p['path'],
    'domain'   => $p['domain'],
    'secure'   => $p['secure'],
    'httponly' => $p['httponly'],
    'samesite' => $p['samesite'],
]);
session_destroy();

header('Location: login.php');
exit;