Bison Infosolutions Knowledgebase

Building a Secure PHP Admin Panel with Session Authentication, TinyMCE Editor, and Smart Slug Generation for a Content Management System

📅 13 Mar 2026 📂 General 👁 2 views

Building a lightweight custom Content Management System (CMS) in PHP is still a practical solution for many small websites, blogs, and digital publications. While large platforms like WordPress offer powerful features, they may introduce unnecessary complexity, security concerns, or performance overhead for simpler projects.

A custom PHP-based CMS allows developers to build exactly what they need — including secure login authentication, content editing tools, structured data storage, and search-friendly URLs.

This article explains how to build and stabilize a PHP admin panel that includes:

Secure admin authentication using PHP sessions
A TinyMCE rich-text editor for writing articles
Automatic slug generation for clean URLs
Content management tools for adding, editing, and deleting stories
Proper logout handling to avoid session persistence issues

The discussion focuses on practical debugging and architecture decisions often encountered during real-world development.

Architecture Overview

A typical custom CMS structure may look like this:

/public_html
│
├── index.php
├── story.php
│
├── /admin
│   ├── login.php
│   ├── logout.php
│   ├── dashboard.php
│   ├── add-story.php
│   ├── edit-story.php
│   └── auth.php
│
├── /includes
│   └── db.php
│
└── /assets
    └── css

Key components:

Database Layer → MySQL / MariaDB via PDO
Authentication Layer → PHP Sessions
Content Editor → TinyMCE
Routing Layer → slug-based article URLs

Implementing Secure Admin Authentication

Authentication is implemented through a login form that validates credentials and sets a session variable.

Example Login Logic


session_start();
if ($username === 'admin' && $password === 'password') {
$_SESSION['admin_logged_in'] = true;
header("Location: /admin/dashboard.php");
    exit;
}

The system uses a session variable:


$_SESSION['admin_logged_in']

Every admin page checks this value.

Access Control (auth.php)


session_start();
if (!isset($_SESSION['admin_logged_in']) || $_SESSION['admin_logged_in'] !== true) {
header("Location: /admin/login.php");
    exit;
}

This prevents unauthorized access to admin pages.

Proper Logout Implementation

Many developers incorrectly assume that session_destroy() alone logs users out. However, PHP session cookies remain in the browser unless explicitly removed.

Incorrect Logout


session_destroy();

Correct Logout Implementation


session_start();
$_SESSION = [];
session_unset();
session_destroy();
if (ini_get("session.use_cookies")) {
$params = session_get_cookie_params();
setcookie(
        session_name(),
        '',
        time() - 42000,
        $params["path"],
        $params["domain"],
        $params["secure"],
        $params["httponly"]
    );
}
header("Location: /admin/login.php");
exit;

This ensures the session cookie is removed from the browser.

Integrating TinyMCE for Rich Text Editing

TinyMCE provides a powerful in-browser editor for writing formatted content.

Include TinyMCE


<script src="https://cdn.tiny.cloud/1/API_KEY/tinymce/8/tinymce.min.js"></script>

Initialize Editor


tinymce.init({
  selector: '#editor',
  height: 460,
  plugins: 'lists link preview code paste',
  toolbar:
    'undo redo | bold italic underline | bullist numlist | link | code'
});

TinyMCE allows administrators to write formatted stories with headings, lists, and links.

Automatic Slug Generation

Search-friendly URLs improve readability and SEO.

Instead of generating slugs from Unicode titles, a structured numbering system can be used.

Example structure:


kahani-1
kahani-2
kavita-1
thought-1
degree-1

Slug Logic


$prefixMap = [
'nikki-kahani' => 'kahani',
    'nikki-kavita' => 'kavita',
    'second-thought' => 'thought',
    '3rd-degree' => 'degree'
];
$prefix = $prefixMap[$section] ?? 'story';
$stmt = $pdo->prepare("SELECT COUNT(*) FROM stories WHERE section = ?");
$stmt->execute([$section]);
$number = $stmt->fetchColumn() + 1;
$slug = $prefix . '-' . $number;

This avoids issues with multilingual titles and ensures predictable URLs.

Database Structure Example

The stories table may contain:


id
title
slug
content
excerpt
section
language
tags
featured
story_date
status
created_at

Slug column should be:


UNIQUE

This ensures that each article has a unique URL.

Handling Content Creation

Adding a story involves:

Collecting form data
Validating required fields
Converting the date format
Generating a slug
Inserting the record using PDO prepared statements

Example Insert Query


INSERT INTO stories
(title, slug, content, excerpt, section, language, tags, featured, story_date, status)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)

Prepared statements protect against SQL injection.

Debugging Common Problems

During development, several common issues may arise:

Session Not Updating

Cause:


session_start() missing

Fix:

Add session_start() at the top of every session-dependent page.

Slug Missing or Empty

Cause:

Slug generation failed.

Fix:

Ensure slug logic always produces a fallback value.

404 Page After Clicking Link

Cause:

Broken internal link pointing to a file that does not exist.

Example:


manage-stories.php

Solution:

Remove the link or create the missing page.

Performance Considerations

A custom CMS can be extremely fast compared to heavy frameworks.

Performance tips:

Use PDO prepared statements
Avoid unnecessary joins
Cache frequent queries
Minimize JavaScript dependencies
Optimize database indexes

Security Best Practices

To maintain a secure admin panel:

Use strong admin passwords
Restrict admin directory access
Validate all user inputs
Use prepared SQL statements
Implement CSRF protection
Sanitize output with htmlspecialchars()

Conclusion

Building a custom PHP admin panel offers flexibility, performance, and control over content management. By combining session-based authentication, a rich text editor like TinyMCE, structured slug generation, and secure database interactions, developers can create a stable and efficient CMS tailored to their needs.

The key lessons include proper session handling, predictable slug systems, and careful debugging of authentication and routing issues.

A well-designed custom CMS can serve as a powerful foundation for blogs, news platforms, or content-driven websites without the overhead of large frameworks.

#PHP #WebDevelopment #PHPDevelopment #CMSDevelopment #TinyMCE #MySQL #DatabaseDesign #AdminPanel #BackendDevelopment #PHPTutorial #PHPProgramming #FullStackDevelopment #WebBackend #PHPMySQL #CodingTutorial #ProgrammingGuide #CustomCMS #ContentManagement #BlogDevelopment #ArticleManagement #SEOURLs #SlugGeneration #SessionManagement #PHPSecurity #LoginSystem #LogoutSystem #Authentication #DatabaseProgramming #DynamicWebsite #WebsiteDevelopment #ProgrammingTips #SoftwareDevelopment #BackendEngineering #CodingProjects #WebApplication #PHPDeveloper #MySQLDatabase #ProgrammingEducation #CodingSkills #PHPBackend #WebProgramming #DeveloperGuide #CodingLearning #TechTutorial #WebDevGuide #ProgrammingHelp #ServerSide #PHPAdminPanel #WebEngineering #CMSArchitecture

php cms php admin panel php login system php session authentication php logout system php session destroy php session cookies php tinyMCE integration tinyMCE editor php php content management system php blog system php article management php m

Building a Secure PHP Admin Panel with Session Authentication, TinyMCE Editor, and Smart Slug Generation for a Content Management System

Architecture Overview

Implementing Secure Admin Authentication

Example Login Logic

Access Control (auth.php)

Proper Logout Implementation

Incorrect Logout

Correct Logout Implementation

Integrating TinyMCE for Rich Text Editing

Include TinyMCE

Initialize Editor

Automatic Slug Generation

Slug Logic

Database Structure Example

Handling Content Creation

Example Insert Query

Debugging Common Problems

Session Not Updating

Slug Missing or Empty

404 Page After Clicking Link

Performance Considerations

Security Best Practices

Conclusion

Was this article helpful?