title: Secure form with single user password (without database)
body: <p>Many Question on StackOverflow about securing user/password form, securing administration section.</p>
  
  <p>For this post I have created a Simple user password form. </p>
  
  <p>I'm looking to use best practice and improve security this form..</p>
  
  <p>Particularity:</p>
  
  <ul>
  <li>no database</li>
  <li>1 user/password only</li>
  <li>1 simple secure page</li>
  </ul>
  
  <p>I know that we miss the Bruteforce system but without this feature, </p>
  
  <p>(WITHOUT MYSQL or DATABASE)</p>
  
  <p>** this example works</p>
  
  <pre><code>if(isset($_POST) &amp;&amp; isset($_POST["send"])):
      $username = isset($_POST['username'])?$_POST['username']:'';
      $password = isset($_POST['password'])?$_POST['password']:'';
      $username = strip_tags( trim( $username ));
      $password = strip_tags( trim( $password ));
      if(preg_match('/^[a-z\d_]{4}$/i', $username) &amp;&amp; $username=='user' &amp;&amp; preg_match('/^[a-z\d_]{8}$/i', $password) &amp;&amp; $password=="password"):
          $_SESSION["login"] = 1;
      else:
          unset($_SESSION["login"]);
      endif;
  endif;
  
  if(!isset($_SESSION['login']) || !$_SESSION['login']): 
  ?&gt;
      &lt;form class="login" action="&lt;?php echo "http://" . $_SERVER["SERVER_NAME"] . $a; ?&gt;" method="post"&gt;
          &lt;input type="text" name="username" placeholder="username" /&gt;&lt;br&gt;
          &lt;input type="password" name="password" placeholder="password" /&gt;&lt;br&gt;
          &lt;button name="send"&gt;&lt;span&gt;Send&lt;/span&gt;&lt;/button&gt;
      &lt;/form&gt;
  &lt;?php else: ?&gt;
      &lt;p&gt;Win !&lt;/p&gt;
  &lt;?php endif; ?&gt;
  </code></pre>