ftp_login()

The PHP ftp_login() function authenticates a user against an FTP server. It is the second step of nearly every FTP session: you first open a connection with ftp_connect(), then call ftp_login() to identify yourself before you can list, download, or upload files. This page explains the parameters, the return value, how to handle a failed login, and the most common gotchas (passive mode, secure connections, and credential safety).

What is ftp_login()?

ftp_login() is a PHP built-in function that logs in to an FTP server with a username and password. The connection must already be open — ftp_login() does not connect by itself; it authenticates over an existing connection handle.

It takes three parameters:

1. ftp — the connection identifier returned by ftp_connect() (or ftp_ssl_connect()).
2. username — the username to log in with. Use anonymous for anonymous FTP servers.
3. password — the password to log in with. For anonymous logins, an email address is conventional.

The function returns a boolean: true on a successful login, false on failure (wrong credentials, an account that is not allowed to log in, etc.).

Syntax of ftp_login()

ftp_login(FTP\Connection $ftp, string $username, string $password): bool

Note: Before PHP 8.1, the first parameter was a resource returned by ftp_connect(). From PHP 8.1 onward it is an FTP\Connection object. Your calling code does not change — only the underlying type does.

Basic usage

A complete, correct session always pairs the login with a connection and a close. Notice that the return value of ftp_connect() is checked before ftp_login() is even attempted, because logging in against false would raise a TypeError.

<?php

// 1. Open a connection (returns false on failure)
$conn = ftp_connect('ftp.example.com');

if ($conn === false) {
    exit("Could not connect to the FTP server.\n");
}

// 2. Authenticate
if (ftp_login($conn, 'username', 'password')) {
    echo "Logged in successfully.\n";
    // ... work with files here ...
} else {
    echo "Login failed: check the username and password.\n";
}

// 3. Always close the connection when finished
ftp_close($conn);

The three calls — connect, login, close — bracket every FTP task. See ftp_close() for why releasing the handle matters.

Error handling in ftp_login()

ftp_login() returns false for a bad login, but it also emits a PHP warning. In production you usually want to suppress that warning and decide what to do yourself. Use the @ operator to silence the warning and branch on the return value:

<?php

$conn = ftp_connect('ftp.example.com');

if ($conn === false) {
    echo "Login failed.\n";
} elseif (@ftp_login($conn, 'username', 'wrong-password') === false) {
    echo "Login failed.\n";
} else {
    echo "Login successful.\n";
}

For an unreachable host or wrong credentials, this prints Login failed. instead of crashing or leaking a raw warning to the page.

Passive mode and secure logins

Two issues trip people up after a successful login:

• Passive mode. Many servers (and most NAT/firewall setups) require passive mode for data transfers such as directory listings and downloads. Turn it on with ftp_pasv() — but only after ftp_login() succeeds, never before.
• Encryption. Plain FTP sends the username and password in cleartext. Prefer FTP over SSL/TLS by opening the connection with ftp_ssl_connect(); ftp_login() then works exactly the same way.

<?php

$conn = ftp_ssl_connect('ftp.example.com'); // encrypted control channel

if ($conn && ftp_login($conn, 'username', 'password')) {
    ftp_pasv($conn, true);                   // enable passive mode after login
    // ... transfer files ...
    ftp_close($conn);
}

Common pitfalls

• Never hard-code credentials in source you commit. Read them from environment variables or a configuration file kept out of version control.
• ftp_login() does not connect. If you pass it a hostname string instead of a connection handle, you get a TypeError. Always call ftp_connect() first.
• A true return only means authentication succeeded. It says nothing about permissions — a later upload can still fail if the account lacks write access.

Conclusion

ftp_login() authenticates an open FTP connection with a username and password, returning true or false. Always connect first, check the return value, enable passive mode after logging in when needed, and prefer an encrypted connection in production. For the full set of related functions, see the PHP FTP reference.

Practice