How to Create a Registration Form in PHP and MySQL

By Ravindra Bagale, trainer · LinkedIn · Last updated: 18 October 2026

1. GET and POST

Why: a registration form has to carry a name, an email and a password from the browser to the server. How the browser sends them decides whether the password stays private.

What: every request from a browser has a method. Two matter here:

1. GET asks the server for something. Typing a URL, clicking a link and refreshing are all GET requests. Any data rides in the URL, after a ?.
2. POST gives data to the server. The data travels inside the request body, so it never appears in the URL, the browser history or the server's access log.

How it looks:

1. You open http://SERVER-IP/register.html: a GET. The server answers with the form.
2. You fill the form and click Register: a POST to signup.php, with name=...&email=...&password=... in the body.
3. The same form without method="POST" falls back to GET, and the browser shows signup.php?name=Asha&email=asha%40example.com&password=MySecret123 in the address bar. Anyone looking at the screen, the history or the log can read the password.

2. The server: nginx, php-fpm and MariaDB

Why: three programs work together on one EC2 server, and all three must be running before the form can work.

What:

1. nginx is the web server on port 80. It sends .html files itself and hands every .php file to php-fpm.
2. php-fpm runs the PHP code.
3. MariaDB is the database server on port 3306.

How:

1. Connect to your Amazon Linux EC2 instance with ssh -i key.pem ec2-user@SERVER-IP.
2. If the three are not installed yet, install them in one go: sudo yum install nginx mariadb105-server php -y.

3. Start them:

   sudo service nginx start
   sudo service mariadb start
   sudo service php-fpm start
   

4. Each one prints Redirecting to /bin/systemctl start nginx.service (or mariadb, php-fpm). That is normal: on Amazon Linux the service command passes the job to systemctl.

5. Go to the folder nginx serves on Amazon Linux: cd /usr/share/nginx/html.

6. Make two test pages:

   echo '<h1>HTML works</h1>' | sudo tee index.html
   echo '<?php phpinfo();' | sudo tee index.php
   

7. Open http://SERVER-IP/index.html and http://SERVER-IP/index.php. The first shows HTML works; the second shows the long purple PHP information page.

1. The PHP information page shows server details, so delete it once you have seen it: sudo rm /usr/share/nginx/html/index.php.

3. PHP's MySQL driver: php-mysqlnd

Why: PHP alone cannot talk to MariaDB. It needs a driver, an extension that knows the MySQL/MariaDB protocol. Without it, the mysqli functions do not exist, and signup.php stops with a blank page or 500 Internal Server Error.

What: on Amazon Linux the package is php-mysqlnd. It matches the PHP version you already have and adds mysqli and pdo_mysql.

How:

1. Install it:

   sudo yum install php-mysqlnd -y
   

2. Restart php-fpm so it loads the new extension:

   sudo service php-fpm restart
   

3. Only php-fpm loads PHP extensions, so nginx and MariaDB need nothing.

4. Check that the driver is there:

   php -m | grep -i mysql
   

5. You should see mysqli, mysqlnd and pdo_mysql.

4. The database: insta, users and an app user

Why: the form needs a table to land in, and the PHP code needs a database login. That login should not be root: if the app's password ever leaks, the damage must stay limited to what the app really needs.

How:

1. Log in with mysql -u root -p.

2. Create the database and the table:

   CREATE DATABASE insta;
   USE insta;
   CREATE TABLE users (
     id       INT AUTO_INCREMENT PRIMARY KEY,
     name     VARCHAR(100) NOT NULL,
     email    VARCHAR(150) NOT NULL UNIQUE,
     password VARCHAR(255) NOT NULL
   );
   

3. One column per form field, plus id that numbers the rows by itself.

4. email is UNIQUE, so one email can register only once.
5. password is VARCHAR(255) because it will hold a hash (section 8), not the typed password. A hash today is 60 characters; 255 leaves room for stronger ones later.

6. Create a user just for the app, with your own password in place of the placeholder:

   CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'YOUR_APP_PASSWORD';
   GRANT SELECT, INSERT ON insta.users TO 'appuser'@'localhost';
   

7. appuser can read and add rows in insta.users, and nothing else. It cannot drop the table or look at other databases.

8. Check with SHOW GRANTS FOR 'appuser'@'localhost';. Try DROP TABLE users; while logged in as appuser and you get ERROR 1142 ... DROP command denied.
9. exit;

5. The four connection values

Why: to open a connection, PHP needs to know where the database is, who is logging in, with which password, and which database to use. If even one value is wrong, nothing gets saved.

What:

1. Server name: where MariaDB runs. Here it is on the same EC2 server as PHP, so localhost.
2. User name: appuser.
3. Password: the one you set in CREATE USER.
4. Database: insta.

How: in PHP the four values are four variables, and one line opens the connection:

$servername = "localhost";
$username   = "appuser";
$password   = "YOUR_APP_PASSWORD";
$database   = "insta";
$conn = new mysqli($servername, $username, $password, $database);

1. localhost always means "this same machine". Its address is 127.0.0.1.
2. With localhost, mysqli connects through MariaDB's local socket file. With 127.0.0.1 it uses TCP port 3306. Both reach the same database.
3. If the database ever moves to its own server (for example Amazon RDS), only $servername changes, to that server's address.

6. The HTML form: action, method and name

Why: three attributes decide where the form data goes, how it travels, and what it is called when it gets there.

What:

1. action="signup.php": the file that receives the data. It must match the PHP file name exactly, including upper and lower case.
2. method="POST": send the data in the request body.
3. name="..." on every input: the label each value carries. PHP finds the value by this name.

How:

1. Create the form: sudo nano /usr/share/nginx/html/register.html

   <!DOCTYPE html>
   <html>
   <head><meta charset="utf-8"><title>Register</title></head>
   <body>
     <h2>Create Account</h2>
     <form action="signup.php" method="POST">
       <label>Name</label>     <input type="text" name="name" required><br>
       <label>Email</label>    <input type="email" name="email" required><br>
       <label>Password</label> <input type="password" name="password" minlength="8" required><br>
       <button type="submit">Register</button>
     </form>
   </body>
   </html>
   

2. type="password" shows dots instead of the letters. required and minlength="8" make the browser check the fields before sending.

3. Open http://SERVER-IP/register.html. A version with some CSS styling looks like the screenshot below; the form tag and the input names are what matter.

1. Want to see the HTML of any page, yours or someone else's? Right-click the page and choose View Page Source (or press Ctrl+U). You can read it, and copy it as a starting point.

1. In the source, find the <form ...> line and check action and method first.

7. $_POST: the form data inside PHP

Why: when the POST arrives, signup.php needs a way to get at each value.

What: PHP puts everything that came in a POST body into $_POST, an array. An array is one variable that holds many values, each under its own key. The keys are the name attributes from the form.

How:

1. For our form, $_POST holds three entries: 'name' => 'Asha', 'email' => 'asha@example.com', 'password' => 'MySecret123'.

2. Take each value out by its key:

   $name  = trim($_POST["name"] ?? "");
   $email = trim($_POST["email"] ?? "");
   $pass  = $_POST["password"] ?? "";
   

3. ?? "" gives an empty string if the field is missing, instead of a warning.

4. trim() removes spaces typed by mistake before or after the name and email.
5. If the key in PHP is spelt differently from the name in HTML ($_POST["Email"] for name="email"), the value is simply empty.

8. signup.php, the safe way

Why: this file decides what lands in your database. Two rules make it safe:

1. Never paste form data into the SQL text. If you build the query as "... VALUES ('$name', ...)", a quote typed in the name field ends your string and the rest runs as SQL. This is called SQL injection. A prepared statement sends the SQL first, with ? for each value, and the values separately, so they can only ever be data.
2. Never store the password itself. password_hash() turns it into a one-way hash. Anyone who reads the table, a backup or a leaked copy sees only hashes.

How: sudo nano /usr/share/nginx/html/signup.php

<?php
// 1. The four connection values
$servername = "localhost";          // same server as PHP (127.0.0.1)
$username   = "appuser";            // limited user, not root
$password   = "YOUR_APP_PASSWORD";  // placeholder: put your own
$database   = "insta";

// Only accept form submissions (POST)
if ($_SERVER["REQUEST_METHOD"] !== "POST") {
    header("Location: register.html");
    exit;
}

// 2. Read the form fields from $_POST
$name  = trim($_POST["name"] ?? "");
$email = trim($_POST["email"] ?? "");
$pass  = $_POST["password"] ?? "";

if ($name === "" || !filter_var($email, FILTER_VALIDATE_EMAIL) || strlen($pass) < 8) {
    exit("Please fill all fields. Password must be at least 8 characters.");
}

mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
try {
    // 3. Connect
    $conn = new mysqli($servername, $username, $password, $database);

    // 4. Store a hash, never the plain password
    $hash = password_hash($pass, PASSWORD_DEFAULT);

    // 5. Prepared statement: data goes separately from the SQL
    $stmt = $conn->prepare("INSERT INTO users (name, email, password) VALUES (?, ?, ?)");
    $stmt->bind_param("sss", $name, $email, $hash);
    $stmt->execute();

    echo "Registration successful. <a href=\"login.html\">Log in</a>";
} catch (mysqli_sql_exception $e) {
    if ($e->getCode() == 1062) {
        echo "An account with this email already exists.";
    } else {
        error_log("signup.php: " . $e->getMessage());
        echo "Something went wrong. Please try again later.";
    }
}

Read it top to bottom:

1. The four connection values from section 5.
2. A GET to signup.php (someone typing its URL) is sent back to the form.
3. The three values come out of $_POST, and are checked: a name, a valid email, a password of at least 8 characters. The browser checks too, but anyone can skip the browser, so the server checks again.
4. mysqli_report(...) makes every database error an exception that the catch block handles.
5. password_hash($pass, PASSWORD_DEFAULT) makes the hash, a 60-character text that starts with $2y$.
6. prepare() sends the SQL with three ?. bind_param("sss", ...) attaches three strings, one per ?, in order. execute() runs it.
7. Error 1062 is the duplicate entry from the UNIQUE email: the user gets a clear message.
8. Any other error goes to the PHP error log for you, while the visitor sees a general message. Database details are never shown on the page.

9. Test the whole flow

Why: a form that "looks fine" proves nothing. Follow one registration all the way into the table.

How:

1. Open http://SERVER-IP/register.html, fill in Asha, asha@example.com and a password of 8 or more characters, and click Register.
2. The page says Registration successful. Log in. The address bar shows just /signup.php, no data.
3. Go back and register the same email again. The page says An account with this email already exists.

4. Check from the database side with mysql -u root -p:

   USE insta;
   SELECT id, name, email, password FROM users;
   

5. Asha's row is there, and the password column holds something like $2y$12$GscnGr53N2GXU/ebcR2Wg..., not the password.

6. Register a second person. Their id is 3, not 2: the failed duplicate insert used up id 2, as with any failed insert into an AUTO_INCREMENT table.
7. Type a name like x'); DROP TABLE users; -- and register. It is saved as a plain name, and users is still there. That is the prepared statement at work.

10. The next step: login.php

Why: registration stores users; a login page checks them. It uses the same pieces in reverse.

What: login.html is the same form with only email and password, and action="login.php". login.php looks up the row by email and lets PHP compare the typed password with the stored hash.

How: sudo nano /usr/share/nginx/html/login.php

<?php
$servername = "localhost";
$username   = "appuser";
$password   = "YOUR_APP_PASSWORD";
$database   = "insta";

if ($_SERVER["REQUEST_METHOD"] !== "POST") {
    header("Location: login.html");
    exit;
}

$email = trim($_POST["email"] ?? "");
$pass  = $_POST["password"] ?? "";

mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
try {
    $conn = new mysqli($servername, $username, $password, $database);

    $stmt = $conn->prepare("SELECT name, password FROM users WHERE email = ?");
    $stmt->bind_param("s", $email);
    $stmt->execute();
    $user = $stmt->get_result()->fetch_assoc();

    if ($user && password_verify($pass, $user["password"])) {
        echo "Welcome, " . htmlspecialchars($user["name"]) . "!";
    } else {
        echo "Wrong email or password.";
    }
} catch (mysqli_sql_exception $e) {
    error_log("login.php: " . $e->getMessage());
    echo "Something went wrong. Please try again later.";
}

1. The query finds the row by email only. Never write WHERE password = '...': the column holds a hash, not the password.
2. password_verify($pass, $user["password"]) hashes the typed password the same way and compares. True means the password is right.
3. A wrong email and a wrong password get the same message, so nobody can use the form to find out which emails are registered.
4. htmlspecialchars() prints the name safely, even if it contains < or quotes.
5. Test: the right password gives Welcome, Asha!; a wrong one gives Wrong email or password.
6. A real app would now start a session (session_start()) to remember the logged-in user from page to page.

11. Let an AI assistant write the code, then fix it

Why: as a cloud engineer you will deploy, configure and debug applications you did not write. AI assistants such as ChatGPT write this kind of code in seconds, but they cannot know your server, your database or your passwords. Your job is to ask clearly and then read and correct every line.

How to write the prompts:

1. One file per prompt, and name everything. For the form: Create a registration form in HTML with name, email and password fields that sends the data with POST to signup.php.
2. Then the script, with your real names and the safety rules: Create signup.php for it: PHP mysqli, database insta, table users with columns name, email and password, prepared statements, password_hash(), and a message if the email already exists.
3. A vague prompt such as make a signup page makes the assistant guess the file name, the fields, the database and the table, and you spend longer fixing the guesses.

What to change in what you get:

1. The four connection values. The assistant writes placeholders such as your_username, your_database or enter your password. They never work as they are.
2. Database, table and column names. Copy them from SHOW DATABASES; and DESC users;.
3. The action of the form must match the PHP file name you actually save.
4. Safety: if the code builds SQL by pasting variables into a string, or stores $_POST["password"] directly, ask for a prepared statement and password_hash(), or change it yourself.
5. Test, then SELECT * FROM users;.

Keep the code safe:

1. A .php file in the web root is run, not shown, so its database password stays on the server.
2. Never leave a copy such as signup.txt or signup.php.bak in /usr/share/nginx/html: nginx sends those as plain text, password and all. To share code, copy it from the terminal or with scp.
3. Never paste your real database password into an AI chat. Use the placeholder and fill it in on the server.

12. Why does my form not work?

Why: almost every broken form comes down to a few small things. Check them in this order.

1. 404 Not Found for register.html: the file is in the wrong folder. nginx on Amazon Linux serves /usr/share/nginx/html. /var/www/html is Apache's folder (and nginx's on Ubuntu), so a file there gives 404 here. Check with ls /usr/share/nginx/html.
2. Register does nothing, or 405 Not Allowed: the form has no action. Without it the browser sends the data back to register.html itself; with method="POST", nginx refuses a POST to a plain .html file with 405. Add action="signup.php".
3. The typed data, password too, appears in the URL: the form has no method, so it uses GET. Add method="POST".

1. 404 Not Found for signup.php: the file name differs from the action: signup.html, Signup.php, sigup.php. Linux file names are case-sensitive.
2. 500 or a blank page: look in the PHP error log. Class "mysqli" not found or Call to undefined function mysqli_... means the driver is missing: sudo yum install php-mysqlnd -y, then sudo service php-fpm restart.
3. Something went wrong, and the log says Access denied for user 'appuser'@'localhost' or Unknown database: a connection value does not match what you created in MariaDB.
4. The log says Unknown column 'fullname' or Table 'insta.user' doesn't exist: the INSERT uses names that are not in your table. Copy them from DESC users;.
5. Where the logs are: nginx writes to /var/log/nginx/error.log (missing files, 404s); PHP errors from php-fpm go to /var/log/php-fpm/www-error.log. Read the last lines with sudo tail -n 20 and the file name.

When you're done practising, delete any test pages you no longer need and stop the EC2 instance.

13. Hands-on lab: one registration, from the form to the table

Why this lab. A form has many links: nginx, php-fpm, the driver, the database, the app user, the HTML and the PHP. This lab checks each link in order, so when a form breaks you know which link to test.

1. Start the three services
   • Command: sudo service nginx start; sudo service mariadb start; sudo service php-fpm start
   • You should see: Three Redirecting to /bin/systemctl start ... lines.
   • Check: sudo service php-fpm status shows active (running); the same for nginx and mariadb.
   • Why: nginx receives the request, php-fpm runs the PHP, MariaDB stores the row. One stopped service breaks the whole form.
2. Install the MySQL driver for PHP
   • Command: sudo yum install php-mysqlnd -y && sudo service php-fpm restart
   • You should see: Complete! and the restart line.
   • Check: php -m | grep -i mysql lists mysqli, mysqlnd and pdo_mysql.
   • Why: PHP alone can't talk to MariaDB. php-fpm loads extensions only at start, hence the restart.
3. Create the database, table and app user
   • Do: Log in with sudo mysql -u root -p and run the CREATE DATABASE insta;, CREATE TABLE users (...), CREATE USER 'appuser'@'localhost' ... and GRANT SELECT, INSERT ON insta.users ... statements from section 4.
   • Check: SHOW GRANTS FOR 'appuser'@'localhost'; lists SELECT, INSERT on insta.users.
   • Why: The app logs in as a user that can only read and add rows in one table. If the code is ever abused, it can't drop tables or read other databases.
4. Test the app login from the terminal
   • Command: mysql -u appuser -p insta -e "SELECT COUNT(*) FROM users;"
   • You should see: After the app password: a small table with 0.
   • Check: No Access denied.
   • Why: If these four values (host, user, password, database) fail here, they will fail in PHP too. Testing here first separates database problems from code problems.
5. Put the form and signup.php in place
   • Do: Create register.html (section 6) and signup.php (section 8) in /usr/share/nginx/html with sudo nano.
   • Check: php -l /usr/share/nginx/html/signup.php → No syntax errors detected.
   • Why: action="signup.php" must match the file name exactly. php -l catches a missing semicolon before a visitor gets a blank page.
6. Register one user
   • Do: Open http://PUBLIC_IP/register.html, fill in a name, an email and a password, and submit.
   • You should see: The success message from signup.php, and the address bar shows /signup.php with no form data in it.
   • Check: No 500 Internal Server Error and no blank page.
   • Why: With method="POST" the data travels in the request body, not in the URL, so the password never shows in the address bar or the browser history.
7. Check the row
   • Command: sudo mysql -u root -p insta -e "SELECT id, name, email, password FROM users;"
   • You should see: One row with your name and email; the password column starts with $2y$.
   • Check: The password you typed does not appear anywhere.
   • Why: password_hash() stores a hash, never the password. If the table leaks, the real passwords don't.
8. Stop the instance
   • Do: EC2 console → Instance state → Stop instance.
   • Check: State Stopped.
   • Why: Three services run all the time on this server. Stopping saves free-tier hours; the database stays on the disk.

14. The whole class on one page

1. GET asks for something and carries data in the URL; POST gives data to the server inside the request body.
2. A form needs action="signup.php" (the receiving file), method="POST", and a name on every input.
3. $_POST is an array: $_POST["email"] is the value of the input named email.
4. Start the stack with sudo service nginx|mariadb|php-fpm start; nginx on Amazon Linux serves /usr/share/nginx/html.
5. PHP needs php-mysqlnd to talk to MariaDB; after installing it, restart only php-fpm.
6. users(id, name, email UNIQUE, password VARCHAR(255)), and an appuser with GRANT SELECT, INSERT ON insta.users, never root.
7. Four connection values: localhost (127.0.0.1), user, password, database.
8. Prepared statement: prepare("... VALUES (?, ?, ?)"), bind_param("sss", ...), execute().
9. password_hash() when storing, password_verify() when logging in.
10. Check with SELECT * FROM users;. A duplicate email gives error 1062 and uses up an id.
11. AI assistants: complete prompts, then fix the placeholders, the names and the action; never paste real passwords.
12. A broken form: folder, action, method, file name, driver, connection values, table and column names, then the logs.

15. Try at home

Recap

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.