Belajar CRUD PHP MySQL dari 0 Sampai Online: Login Multi-Role + Konsep IPO

CREATE DATABASE IF NOT EXISTS belajar_crud
  DEFAULT CHARACTER SET utf8mb4
  COLLATE utf8mb4_general_ci;

USE belajar_crud;

CREATE TABLE IF NOT EXISTS users (
  id INT AUTO_INCREMENT PRIMARY KEY,
  nama VARCHAR(100) NOT NULL,
  email VARCHAR(100) NOT NULL UNIQUE,
  password VARCHAR(255) NOT NULL,
  role ENUM('admin','user') NOT NULL DEFAULT 'user',
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
) ENGINE=InnoDB;

-- Password admin: admin123
INSERT INTO users (nama, email, password, role) VALUES
('Administrator', '[email protected]', '$2y$10$6nJg8fV7BwSjNK75xwz4POGX0mrwv6IzHtqv0Siju0uKcS.tEJwJ.', 'admin'),
('Budi Santoso', '[email protected]', '$2y$10$ywX3wS4NcUYwG64I.iHaNO9kRCHYn0DeN972ehQQyWCXvw/JhnhNa', 'user')
ON DUPLICATE KEY UPDATE nama = VALUES(nama);

<?php
// Memulai session PHP agar variabel $_SESSION bisa digunakan di seluruh halaman
session_start();

// Pengaturan koneksi database MySQL
$DB_HOST = 'localhost';
$DB_USER = 'root';
$DB_PASS = '';
$DB_NAME = 'belajar_crud';

// Membuat koneksi ke database
$conn = mysqli_connect($DB_HOST, $DB_USER, $DB_PASS, $DB_NAME);

// Cek apakah koneksi berhasil atau gagal
if (!$conn) {
    die('Koneksi ke database gagal: ' . mysqli_connect_error());
}

// Mengatur charset UTF-8
mysqli_set_charset($conn, 'utf8mb4');

// Fungsi pembantu: Cek apakah user sudah login
function sudahLogin() {
    return isset($_SESSION['user_id']);
}

// Fungsi pembantu: Wajibkan login (jika belum, arahkan ke login.php)
function wajibLogin() {
    if (!sudahLogin()) {
        header('Location: login.php');
        exit;
    }
}

// Fungsi pembantu: Wajibkan role admin (jika bukan admin, hentikan proses)
function wajibAdmin() {
    wajibLogin();
    if ($_SESSION['role'] !== 'admin') {
        die('Akses ditolak: halaman ini khusus untuk pengguna dengan peran Admin.');
    }
}

<?php
// Memanggil konfigurasi & session
require_once 'config.php';

// Memeriksa status login dari session
$login = sudahLogin();
$nama = $login ? ($_SESSION['nama'] ?? '') : '';
$role = $login ? ($_SESSION['role'] ?? '') : '';
?>
<!DOCTYPE html>
<html lang="id">
<head>
  <meta charset="utf-8">
  <title>Aplikasi CRUD User - Bahan Belajar PHP</title>
</head>
<body>

  <h1>Aplikasi CRUD Sederhana (PHP &amp; MySQL)</h1>
  <p>Contoh bahan ajar konsep <strong>IPO (Input - Proses - Output)</strong> untuk PEMULA.</p>

  <hr>

  <?php if ($login): ?>
    <p>Halo, <strong><?= htmlspecialchars($nama) ?></strong> (Role: <?= htmlspecialchars($role) ?>)</p>
    <p>
      <a href="dashboard.php">[ Masuk ke Dashboard ]</a>
      <a href="logout.php">[ Logout ]</a>
    </p>
  <?php else: ?>
    <p>Silakan masuk atau buat akun baru:</p>
    <p>
      <a href="login.php">[ Halaman Login ]</a> |
      <a href="register.php">[ Halaman Register ]</a>
    </p>
  <?php endif; ?>

  <hr>

  <h3>Akun Uji Coba:</h3>
  <ul>
    <li><strong>Admin:</strong> [email protected] / admin123 (bisa kelola semua data)</li>
    <li><strong>User:</strong> [email protected] / user123 (hanya bisa edit data diri)</li>
  </ul>

</body>
</html>

<?php
require_once 'config.php';

// Jika sudah login, langsung alihkan ke dashboard
if (sudahLogin()) {
    header('Location: dashboard.php');
    exit;
}

$error = '';

// 1. INPUT (Menerima input pendaftaran dari form POST)
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $nama       = trim($_POST['nama'] ?? '');
    $email      = trim($_POST['email'] ?? '');
    $password   = $_POST['password'] ?? '';
    $konfirmasi = $_POST['konfirmasi'] ?? '';

    // 2. PROSES (Validasi Input, Cek Duplikasi, Hash, Simpan DB)
    if ($nama === '' || $email === '' || $password === '') {
        $error = 'Nama, email, dan password wajib diisi!';
    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $error = 'Format penulisan email tidak valid!';
    } elseif (strlen($password) < 6) {
        $error = 'Password minimal harus 6 karakter!';
    } elseif ($password !== $konfirmasi) {
        $error = 'Konfirmasi password tidak cocok!';
    } else {
        // Cek apakah email sudah terdaftar sebelumnya
        $stmt = mysqli_prepare($conn, 'SELECT id FROM users WHERE email = ? LIMIT 1');
        mysqli_stmt_bind_param($stmt, 's', $email);
        mysqli_stmt_execute($stmt);
        mysqli_stmt_store_result($stmt);
        $sudahAda = mysqli_stmt_num_rows($stmt) > 0;
        mysqli_stmt_close($stmt);

        if ($sudahAda) {
            $error = 'Email sudah digunakan. Silakan gunakan email lain atau langsung login.';
        } else {
            $hash = password_hash($password, PASSWORD_DEFAULT);
            $role = 'user';

            $stmt = mysqli_prepare($conn, 'INSERT INTO users (nama, email, password, role) VALUES (?, ?, ?, ?)');
            mysqli_stmt_bind_param($stmt, 'ssss', $nama, $email, $hash, $role);

            if (mysqli_stmt_execute($stmt)) {
                mysqli_stmt_close($stmt);
                // 3. OUTPUT (Jika Berhasil: Redirect ke halaman Login)
                header('Location: login.php?daftar=sukses');
                exit;
            } else {
                $error = 'Gagal menyimpan ke database, silakan coba lagi.';
                mysqli_stmt_close($stmt);
            }
        }
    }
}
?>

<form method="post" action="register.php">
  <input type="text" name="nama" id="nama" required value="<?= htmlspecialchars($_POST['nama'] ?? '') ?>">
  <input type="email" name="email" id="email" required value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
  <input type="password" name="password" id="password" required>
  <input type="password" name="konfirmasi" id="konfirmasi" required>
  <button type="submit">Daftar Sekarang</button>
</form>

<?php
require_once 'config.php';

if (sudahLogin()) {
    header('Location: dashboard.php');
    exit;
}

$error = '';

// 1. INPUT
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $email    = trim($_POST['email'] ?? '');
    $password = $_POST['password'] ?? '';

    // 2. PROSES
    if ($email === '' || $password === '') {
        $error = 'Email dan password tidak boleh kosong!';
    } else {
        $stmt = mysqli_prepare($conn, 'SELECT id, nama, email, password, role FROM users WHERE email = ? LIMIT 1');
        mysqli_stmt_bind_param($stmt, 's', $email);
        mysqli_stmt_execute($stmt);
        $result = mysqli_stmt_get_result($stmt);
        $user = mysqli_fetch_assoc($result);
        mysqli_stmt_close($stmt);

        if ($user && password_verify($password, $user['password'])) {
            $_SESSION['user_id'] = $user['id'];
            $_SESSION['nama']    = $user['nama'];
            $_SESSION['email']   = $user['email'];
            $_SESSION['role']    = $user['role'];

            // 3. OUTPUT sukses
            header('Location: dashboard.php');
            exit;
        } else {
            $error = 'Email atau password salah!';
        }
    }
}
?>

<?php
require_once 'config.php';
wajibLogin();

// 1. INPUT
$userId   = (int)$_SESSION['user_id'];
$namaUser = $_SESSION['nama'];
$roleUser = $_SESSION['role'];
$isAdmin  = ($roleUser === 'admin');
$pesanNotifikasi = $_GET['pesan'] ?? '';

// 2. PROSES
if ($isAdmin) {
    $query = mysqli_query($conn, 'SELECT id, nama, email, role, created_at FROM users ORDER BY id ASC');
    $users = mysqli_fetch_all($query, MYSQLI_ASSOC);
} else {
    $stmt = mysqli_prepare($conn, 'SELECT id, nama, email, role, created_at FROM users WHERE id = ? LIMIT 1');
    mysqli_stmt_bind_param($stmt, 'i', $userId);
    mysqli_stmt_execute($stmt);
    $res   = mysqli_stmt_get_result($stmt);
    $users = [mysqli_fetch_assoc($res)];
    mysqli_stmt_close($stmt);
}
?>

<table border="1" cellpadding="8" cellspacing="0" width="100%">
  <!-- header: No | Nama | Email | Role | Dibuat | Aksi -->
  <?php $no = 1; foreach ($users as $u): ?>
    <tr>
      <td><?= $no++ ?></td>
      <td><?= htmlspecialchars($u['nama']) ?></td>
      <td><?= htmlspecialchars($u['email']) ?></td>
      <td><?= htmlspecialchars($u['role']) ?></td>
      <td><?= htmlspecialchars($u['created_at']) ?></td>
      <td>
        <a href="edit.php?id=<?= (int)$u['id'] ?>">Edit</a>
        <!-- Hapus cuma muncul kalau admin + bukan akun sendiri -->
      </td>
    </tr>
  <?php endforeach; ?>
</table>

<?php
require_once 'config.php';
wajibAdmin();

$error = '';

// 1. INPUT
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $nama     = trim($_POST['nama'] ?? '');
    $email    = trim($_POST['email'] ?? '');
    $password = $_POST['password'] ?? '';
    $role     = $_POST['role'] ?? 'user';
    if (!in_array($role, ['admin', 'user'], true)) {
        $role = 'user';
    }

    // 2. PROSES
    if ($nama === '' || $email === '' || $password === '') {
        $error = 'Semua field wajib diisi!';
    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $error = 'Format penulisan email tidak valid!';
    } elseif (strlen($password) < 6) {
        $error = 'Password minimal harus 6 karakter!';
    } else {
        $hash = password_hash($password, PASSWORD_DEFAULT);
        $stmt = mysqli_prepare($conn, 'INSERT INTO users (nama, email, password, role) VALUES (?, ?, ?, ?)');
        mysqli_stmt_bind_param($stmt, 'ssss', $nama, $email, $hash, $role);

        if (mysqli_stmt_execute($stmt)) {
            mysqli_stmt_close($stmt);
            // 3. OUTPUT
            header('Location: dashboard.php?pesan=User+berhasil+ditambahkan');
            exit;
        } else {
            $error = 'Gagal menambahkan user. Kemungkinan email sudah digunakan.';
            mysqli_stmt_close($stmt);
        }
    }
}
?>

<?php
require_once 'config.php';
wajibLogin();

// 1. INPUT TAHAP 1 (ID dari URL)
$id = (int)($_GET['id'] ?? 0);
if ($id <= 0) {
    die('ID pengguna tidak valid.');
}

// User biasa DILARANG mengedit user lain
if ($_SESSION['role'] !== 'admin' && $id !== (int)$_SESSION['user_id']) {
    die('Akses ditolak: Anda hanya berhak mengubah data Anda sendiri.');
}

// Ambil data saat ini untuk ditampilkan di form
$stmt = mysqli_prepare($conn, 'SELECT id, nama, email, role FROM users WHERE id = ? LIMIT 1');
mysqli_stmt_bind_param($stmt, 'i', $id);
mysqli_stmt_execute($stmt);
$res  = mysqli_stmt_get_result($stmt);
$user = mysqli_fetch_assoc($res);
mysqli_stmt_close($stmt);

if (!$user) {
    die('Data user tidak ditemukan di database.');
}
?>

<?php
// 1. INPUT TAHAP 2 (data baru dari POST)
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $nama         = trim($_POST['nama'] ?? '');
    $email        = trim($_POST['email'] ?? '');
    $passwordBaru = $_POST['password'] ?? '';

    if ($_SESSION['role'] === 'admin') {
        $role = $_POST['role'] ?? $user['role'];
        if (!in_array($role, ['admin', 'user'], true)) {
            $role = 'user';
        }
    } else {
        $role = $user['role'];
    }

    // 2. PROSES
    if ($nama === '' || $email === '') {
        $error = 'Nama dan email tidak boleh kosong!';
    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $error = 'Format penulisan email tidak valid!';
    } else {
        // Cek email dipakai user LAIN atau tidak
        $stmt = mysqli_prepare($conn, 'SELECT id FROM users WHERE email = ? AND id <> ? LIMIT 1');
        mysqli_stmt_bind_param($stmt, 'si', $email, $id);
        mysqli_stmt_execute($stmt);
        mysqli_stmt_store_result($stmt);
        $emailSudahDipakai = mysqli_stmt_num_rows($stmt) > 0;
        mysqli_stmt_close($stmt);

        if ($emailSudahDipakai) {
            $error = 'Email tersebut sudah digunakan oleh akun lain!';
        } else {
            if ($passwordBaru !== '') {
                if (strlen($passwordBaru) < 6) {
                    $error = 'Password baru minimal harus 6 karakter!';
                } else {
                    $hash = password_hash($passwordBaru, PASSWORD_DEFAULT);
                    $stmt = mysqli_prepare($conn, 'UPDATE users SET nama=?, email=?, password=?, role=? WHERE id=?');
                    mysqli_stmt_bind_param($stmt, 'ssssi', $nama, $email, $hash, $role, $id);
                }
            } else {
                $stmt = mysqli_prepare($conn, 'UPDATE users SET nama=?, email=?, role=? WHERE id=?');
                mysqli_stmt_bind_param($stmt, 'sssi', $nama, $email, $role, $id);
            }

            if ($error === '') {
                if (mysqli_stmt_execute($stmt)) {
                    mysqli_stmt_close($stmt);
                    if ($id === (int)$_SESSION['user_id']) {
                        $_SESSION['nama']  = $nama;
                        $_SESSION['email'] = $email;
                        $_SESSION['role']  = $role;
                    }
                    // 3. OUTPUT
                    header('Location: dashboard.php?pesan=Data+berhasil+diperbarui');
                    exit;
                }
            }
        }
    }
}
?>

<?php
// hapus.php
require_once 'config.php';
wajibAdmin();

$id = (int)($_GET['id'] ?? 0);
if ($id <= 0) {
    die('ID pengguna tidak valid.');
}

// Admin tidak boleh menghapus akunnya sendiri
if ($id === (int)$_SESSION['user_id']) {
    die('Akses ditolak: Anda tidak bisa menghapus akun yang sedang Anda gunakan.');
}

$stmt = mysqli_prepare($conn, 'DELETE FROM users WHERE id = ?');
mysqli_stmt_bind_param($stmt, 'i', $id);
mysqli_stmt_execute($stmt);
mysqli_stmt_close($stmt);

header('Location: dashboard.php?pesan=User+berhasil+dihapus');
exit;

<?php
// logout.php
require_once 'config.php';

session_unset();
session_destroy();

header('Location: login.php');
exit;

$DB_HOST = "sqlxxx.infinityfree.com"; // lihat di dashboard hosting, bukan localhost
$DB_USER = "if0_12345678";
$DB_PASS = "password_hosting_kalian";
$DB_NAME = "if0_12345678_belajar_crud";