Just a simple user authentication solution inside a super-simple framework skeleton that works out-of-the-box (and comes with an auto-installer), using the future-proof official bcrypt password hashing/salting implementation of PHP 5.5+, plus some nice features that will speed up the time from idea to first usable prototype application dramatically. Nothing more. This project has its focus on hardcore simplicity. Everything is as simple as possible, made for smaller projects, typical agency work and quick pitch drafts. If you want to build massive corporate applications with all the features modern frameworks have, then have a look at Laravel, Symfony or Yii, but if you just want to quickly create something that just works, then this script might be interesting for you.
HUGE's simple-as-possible architecture was inspired by several conference talks, slides and articles about huge applications that - surprisingly and intentionally - go back to the basics of programming, using procedural programming, static classes, extremely simple constructs, not-totally-DRY code etc. while keeping the code extremely readable (StackOverflow, Wikipedia, SoundCloud).
- Features
- Live-Demo
- Support
- Follow the project
- License
- Requirements
- Auto-Installation
- Installation (Ubuntu 14.04 LTS)
- Documentation
- Why is there no support forum anymore ?
- Zero tolerance for idiots, trolls and vandals
- Contribute
- Report a bug
This script was formerly named "php-login" and by far the most popular version of the 4 simple PHP user auth scripts of The PHP Login Project (a collection of simple login scripts, made to prevent people from using totally outdated and insecure MD5 password hashing, which was still very popular in the PHP world back in 2012).
Why the name "HUGE" ? It's a nice combination to TINY, MINI and MINI2, my other projects :)
- built with the official PHP password hashing functions, fitting the most modern password hashing/salting web standards
- users can register, login, logout (with username, email, password)
- [planned: OAuth2 implementation for proper future-proof 3rd party auth]
- password-forget / reset
- remember-me (login via cookie)
- account verification via mail
- captcha
- failed-login-throttling
- user profiles
- account upgrade / downgrade
- supports local avatars and remote Gravatars
- supports native mail and SMTP sending (via PHPMailer and other tools)
- uses PDO for database access for sure, has nice DatabaseFactory (in case your project goes big)
- uses URL rewriting ("beautiful URLs")
- proper split of application and public files (requests only go into /public)
- uses Composer to load external dependencies (PHPMailer, Captcha-Generator, etc.)
- fits PSR-0/1/2/4 coding guidelines
- masses of comments
- is actively developed, maintained and bug-fixed
See a live demo here and the server's phpinfo() here.
There a lot of work behind this project. I might save you hundreds, maybe thousands of hours of work (calculate that in developer costs). So when you are earning money by using HUGE, be fair and give something back to open-source. HUGE is totally free to private and commercial use.
TODO new banners
You can also rent your next $5 server at Virpus or DigitalOcean or donate via PayPal.
Also feel free to contribute to this project.
Here on Twitter or Facebook. I'm also blogging at Dev Metal.
Licensed under MIT. Totally free for private or commercial projects.
Make sure you know the basics of object-oriented programming and MVC, are able to use the command line and have used Composer before. This script is not for beginners.
- PHP 5.5+
- MySQL 5 database (better use versions 5.5+ as very old versions have a PDO injection bug
- installed PHP extensions: pdo, gd, openssl (the install guideline shows how to do)
- installed tools on your server: git, curl, composer (the install guideline shows how to do)
- for professional mail sending: an SMTP account (I use SMTP2GO)
- activated mod_rewrite on your server (the install guideline shows how to do)
Yo, fully automatic. Why ? Because I always hated it to spend days trying to find out how to install a thing. This will save you masses of time and nerves. Donate a coffee if you like it.
If you are using Vagrant for your development, then simply
- Add the official Ubuntu 14.04 LTS box to your Vagrant:
vagrant box add ubuntu/trusty64 - Move Vagrantfile and bootstrap.sh (from _one-click-installation folder) to a folder where you want to initialize your project.
- Do
vagrant upin that folder.
5 minutes later you'll have a fully installed HUGE inside Ubuntu 14.04 LTS. The full code will be auto-synced with the current folder. MySQL root password and the PHPMyAdmin root password are set to 12345678. By default 192.168.33.111 is the IP of your new box.
Extremely simple installation in a fresh and naked typical Ubuntu 14.04 LTS server:
Download the installer script
wget https://raw.githubusercontent.com/panique/huge/master/_one-click-installation/bootstrap.shMake it executable
chmod +x bootstrap.shRun it! Give it some minutes to perform all the tasks. And yes, you can thank me later :)
sudo ./bootstrap.shThis script is very fresh, so the install guidelines are not perfect yet.
- Make sure you have Apache, PHP, MySQL installed. Tutorial.
- Clone the repo to a folder on your server
- Activate mod_rewrite, route all traffic to application's /public folder. Tutorial.
- Edit application/config: Set your database credentials
- Execute SQL statements from application/_installation to setup database tables
- Install Composer,
run
Composer installon application's root folder to install dependencies - Make avatar folder (application/public/avatars) writable
- For proper email usage: Set SMTP credentials in config file, set EMAIL_USE_SMTP to true
"Email does not work" ? See the troubleshooting below. TODO
This is just a quick guideline for easy setup of a development environment!
Make sure you have Apache, PHP 5.5+ and MySQL installed. Tutorial here. Nginx will work for sure too, but no install guidelines are available yet.
Edit vhost to make clean URLs possible and route all traffic to /public folder of your project:
sudo nano /etc/apache2/sites-available/000-default.confand make the file look like
<VirtualHost *:80>
DocumentRoot "/var/www/html/public"
<Directory "/var/www/html/public">
AllowOverride All
Require all granted
</Directory>
</VirtualHost>
Enable mod_rewrite and restart apache.
sudo a2enmod rewrite
service apache2 restartInstall curl (needed to use git), openssl (needed to clone from GitHub, as github is https only), PHP GD, the graphic lib (we create captchas and avatars), and git.
sudo apt-get -y install curl
sudo apt-get -y install php5-curl
sudo apt-get -y install openssl
sudo apt-get -y install php5-gd
sudo apt-get -y install gitgit clone HUGE
sudo git clone https://github.com/panique/huge "/var/www/html"Install Composer
curl -s https://getcomposer.org/installer | php
mv composer.phar /usr/local/bin/composerGo to project folder, load Composer packages (--dev is optional, you know the deal)
cd /var/www/html
composer install --devExecute the SQL statements. Via phpmyadmin or via the command line for example. 12345678 is the example password. Note that this is written without a space.
sudo mysql -h "localhost" -u "root" "-p12345678" < "/var/www/html/application/_installation/01-create-database.sql"
sudo mysql -h "localhost" -u "root" "-p12345678" < "/var/www/html/application/_installation/02-create-table-users.sql"
sudo mysql -h "localhost" -u "root" "-p12345678" < "/var/www/html/application/_installation/03-create-table-notes.sql"Make avatar folder writable
sudo chmod 0777 -R "/var/www/html/public/avatars"Remove Apache's default demo file
sudo rm "/var/www/html/index.html"Edit the application's config in application/config.development.php and put in your database credentials.
Last part (not needed for a first test): Set your SMTP credentials in the same file and set EMAIL_USE_SMTP to true, so you can send proper emails. It's highly recommended to use SMTP for mail sending! Native sending via PHP's mail() will not work in nearly every case (spam blocking). I use SMTP2GO.
Then check your server's IP / domain. Everything should work fine.
By default HUGE has a demo-user: username is demo, password is 12345678. The user is already activated.
There are several files in the root folder of the project that might be irritating:
- .htaccess (optionally) routes all traffic to /public/index.php! If you installed this project correctly, then this file is not necessary, but as lots of people have problems setting up the vhost correctly, .htaccess it still there to increase security, even on partly-broken-installations.
- .scrutinizer.yml (can be deleted): Configs for the external code quality analyzer Scrutinizer, just used here on GitHub, you don't need this for your project.
- .travis.yml (can be deleted): Same like above. Travis is an external service that creates installations of this repo after each code change to make sure everything runs fine. Also runs the unit tests. You don't need this inside your project.
- composer.json (important): You should know what this does. ;) This file says what external dependencies are used.
- travis-ci-apache (can be deleted): Config file for Travis, see above, so Travis knows how to setup the Apache.
README and CHANGELOG are self-explaining.
A real documentation is in the making. Until then, please have a look at the code and use your IDE's code completion features to get an idea how things work, it's quite obvious when you look at the controller files, the model files and how data is shown in the view files. A big sorry that there's no documentation yet, but time is rare :)
TODO: Full documentation TODO: Basic examples on how to do things
There were two (!) support forums for v1 and v2 of this project (HUGE is v3), and both were vandalized by people who didn't even read the readme and / or the install guidelines. Most asked question was "script does not work plz help" without giving any useful information (like code or server setup or even the version used). While I'm writing these lines somebody just asked via Twitter "how to install without Composer". You know what I mean :) ... Beside, 140 characters on Twitter are not a clever way to ask for / describe a complex development situation. 99% of the questions were not necessary if the people would had read the guidelines, do a minimal research on their own or would stop making things so unnecessarily complicated. And even when writing detailed answers most of them still messed it up, resulting in rants and complaints (for free support for a free software!). It was just frustrating to deal with this every day, especially when people take it for totally granted that it's the duty of open-source developers to give detailed, free and personal support for every "plz help"-request.
So I decided to completely stop any free support. For serious questions about real problems inside the script please use the GitHub issues feature.
Harsh words, but as basically every public internet project gets harassed, vandalized and trolled these days by very strange people it's necessary: Some simple rules.
-
Respect that this is just a simple script written by unpaid volunteers in their free-time. This is NOT business-software you've bought for $10.000. There's no reason to complain (!) about free open-source software. The attitude against free software is really frustrating these days, people take everything for granted without realizing the work behind it, and the fact they they get serious software totally for free, saving thousands of dollars. If you don't like it, then don't use it. If you want a feature, try to take part in the process, maybe even build it by yourself and add it to the project! Be nice and respectful. Constructive criticism is for sure always welcome!
-
Don't bash, don't hate, don't spam, don't vandalize. Don't ask for personal free support, don't ask if somebody could do your work for you. Before you ask something, make sure you've read the README, followed every tutorial, double-checked the code and tried to solve the problem by yourself.
Trolls and very annoying people will get a permanent ban / block. GitHub has a very powerful anti-abuse team.
Please commit only in develop branch. The master branch will always contain the stable version.
Due to the possible consequences when publishing a bug on a public open-source project I'd kindly ask you to send really big bugs to my email address, not posting this here. If the bug is not interesting for attackers: Feel free to create an normal GitHub issue.
See active issues and requested features here: https://github.com/panique/huge/issues?state=open
- How to use PDO
- A short guideline on how to use the PHP 5.5 password hashing functions and its PHP 5.3 & 5.4 implementations
- How to setup latest version of PHP 5.5 on Ubuntu 12.04 LTS
- How to setup latest version of PHP 5.5 on Debian Wheezy 7.0/7.1 (and how to fix the GPG key error)
- Notes on password & hashing salting in upcoming PHP versions (PHP 5.5.x & 5.6 etc.)
- Some basic "benchmarks" of all PHP hash/salt algorithms
- How to prevent PHP sessions being shared between different apache vhosts / different applications
- Weird! When I renamed php-login to HUGE (to get rid off the too generic project name and to make it fitting nicely to MINI, TINY and MINI2, my other projects) I had a research if the word "huge" is already used in the php world for sure. Nothing came up. Then, weeks later, I stumbled upon this: https://github.com/ffremont/HugeRest I nice little framework in PHP, but it has only 1 star on Github, so it's obviously not so widely used. Looks very professional, too. Hmm.... The guy behind published the entire readme etc. in pure french (!), so it's hard to use for non-french-speaking people. However, I'm not related to him in any way, this is pure coincidence.