<?php

session_start();

$pdo = new PDO("mysql:host=localhost;dbname=database", 'username', 'password');

if(isset($_POST['formreg'])) {
    $username = $_POST['user_input'];
    $password = $_POST['pass_input'];

    $query = $pdo->prepare("INSERT INTO users (user,pass) VALUES (:user_token,:pass_token)");
    $values = array(
        "user_token" => $username,
        "pass_token" => sha1($password)
    );
    $query->execute($values);
}

if(isset($_POST['formlog'])) {
    $username = $_POST['user_input'];
    $password = $_POST['pass_input'];

    $query = $pdo->prepare("SELECT * FROM users WHERE user=:user_token LIMIT 1");
    $values = array(
        "user_token" => $username
    );
    $query->execute($values);
    $row = $query->fetch(PDO::FETCH_ASSOC);
    if($row !== false) {
        if($row["pass"] === sha1($password)) {
            echo "Login success.";
            $_SESSION["username"] = $row["user"];
        } else {
            echo "Wrong password.";
        }
    } else {
        echo "Username doesn't exist.";
    }
}

if(isset($_POST['formlogout'])) {
    session_destroy();
}

?>

<h1>Login</h1>
<form action="index.php" method="post">
username: <input type="text" name="user_input"><br>
password: <input type="password" name="pass_input"><br>
<input type="hidden" name="formlog" value="1">
<input type="submit">
</form>

<?php if(isset($_SESSION['username'])): ?>
<h1>Logout</h1>
<form action="index.php" method="post">
<input type="hidden" name="formlogout" value="1">
<input type="submit">
</form>
<?php endif; ?>

<h1>Register</h1>
<form action="index.php" method="post">
username: <input type="text" name="user_input"><br>
password: <input type="password" name="pass_input"><br>
<input type="hidden" name="formreg" value="1">
<input type="submit">
</form>