The QR Code Attendance Management System is a web-based attendance application developed with PHP 8.2, MySQL, JavaScript, AdminLTE and browser-based QR scanning. It is designed for schools, companies, offices, clubs, training centres, events and other organizations that need a practical way to register people and record their attendance. The system generates a unique QR code for every registered person, validates attendance against assigned schedules and records Time In and Time Out automatically. Unlike attendance projects built only for students or employees, this Universal Edition uses configurable People, Categories and Departments, which makes it suitable for different types of organizations without changing the source code.
| Project Name | QR Code Attendance Management System |
| Edition | Universal |
| Project type | Web Application |
| Programming language | PHP 8.2 or newer |
| Database | MySQL 8.0 or MariaDB 10.5+ |
| Database name | universal_qr_attendance |
| Frontend | HTML5, Bootstrap, JavaScript |
| Admin template | AdminLTE 3.2 |
| User roles | Super Admin, Admin, Staff/Operator |
| Attendee model | People with configurable categories |
| Main feature | QR-based Time In and Time Out |
| Public scanner | Separate self-service attendance kiosk |
| Last tested/reviewed | 17 August 2026 |
| License/use | Educational and personal project use |
| Download format | ZIP |
| SQL file included | Yes |
| Installation method | Web installer or manual SQL import |
| Local server support | XAMPP-compatible setup |
| Reporting formats | PDF, XLSX, CSV and Print |
Traditional attendance recording often relies on paper registers, spreadsheets or manual data entry. These methods can work for a small group, but they become difficult to manage when an organisation needs accurate arrival times, departure times, late records, attendance summaries and historical reports. This QR Code Attendance Management System replaces that repetitive process with a central web application. Each registered person receives a unique Person ID and QR code. The QR code can be printed on an ID card, downloaded as an image or displayed on a mobile device. When it is scanned, the system checks the person, QR validity, assigned schedule, active attendance day, allowed scan window and existing attendance record before saving the result.
This QR Code Attendance Management System in PHP MySQL project is intended for: Schools and colleges, Offices and private companies, Training centres, Clubs and membership organisations, Volunteer groups, Conferences and seminars, Temporary events, Mixed organisations with several attendee types.
Instead of storing separate student, employee, visitor and volunteer records, the system stores everyone in a single people table. A person is then classified using a configurable category such as Student, Employee, Faculty, Visitor, Contractor, Volunteer, Member, or Guest. This design makes the project more flexible than a basic student attendance system. An administrator can create new categories and departments without editing PHP files or creating additional database tables.
The application also goes beyond a normal CRUD project. It includes schedule-based validation, QR token history, duplicate-scan prevention, automatic Time In and Time Out, attendance correction logs, role permissions, dashboard analytics, reporting, exports, notifications, holidays, announcements, database backup and a separate public attendance kiosk.
The following project demonstration shows the QR Code Attendance Management System in PHP and MySQL in actual use. The video covers the administration dashboard, People registration, QR code generation, attendance schedules, QR scanning, the public attendance kiosk, Time In and Time Out processing, attendance records and reporting features. Watch the complete demonstration below to understand how the system works before downloading and installing the source code.
The main objectives of the QR Code Attendance Management System in PHP MySQL are:
The project is copied to the web-server directory and its Composer dependencies are installed. The administrator then opens public/install.php, enters the database details and creates the first Super Administrator account. The installer creates or connects to the universal_qr_attendance database, imports database/schema.sql, inserts the initial roles and settings, and generates the .env configuration file.
The Super Administrator signs in using the account created during installation. After a successful login, the system regenerates the session ID and opens the administration dashboard. The dashboard displays attendance statistics, recent records, Time In and Time Out summaries, late counts, announcements and attendance charts.
Before adding people, the Super Administrator can configure: Organisation name, Organisation logo, Timezone, Person ID prefix, Person ID length, Default late threshold, Low-attendance threshold, QR size, QR prefix, Scanner sound, Public kiosk status, Public kiosk title, Scanner location, Optional kiosk access key.
Categories define what type of person is being registered. The default database includes categories such as: Student, Employee, Faculty, Visitor, Contractor, Volunteer, Member, Guest. Administrators can add more categories without changing the source code.
Departments organise people into smaller units. Some of the examples include: Information Technology, Human Resources, Accounting, Sales, BSIT, BSHM, Committee A, Committee B. Departments can also contain parent groups, allowing an organisation to create a simple hierarchy.
An attendance schedule defines when attendance can be recorded. Here, each schedule can contain: Schedule name, Start time, End time, Late threshold, Allowed scan time before the start, Allowed scan time after the end, Available weekdays, Active or inactive status. Also, schedules can be assigned to a specific person, a department, or a category. When several schedule assignments are available, the system checks them in this order: Person-specific schedule mapping, Schedule selected directly on the person record, Department schedule, Category schedule.
An administrator registers a person and enters the available information: Full name, Gender, Birthdate, Contact number, Email address, Address, Category, Department or group, Position or role, Photo, Status, Attendance schedule. The system creates a unique Person ID and a cryptographically random QR token.
After the person is saved, the system generates a QR image and links it to that person. The QR code can be previewed, downloaded, printed on a QR card, generated in bulk, or regenerated when required. Regenerating the QR code disables the previous token. An old or replaced QR code will no longer be accepted.
The organisation provides the QR code to the person. It may be: Printed on an ID card, Printed on a visitor badge, Downloaded as an image, Saved on a mobile phone, or Included on a membership card.
The organisation opens the public scanner on a shared phone, tablet, laptop or desktop computer. The default kiosk URL is: http://localhost/universal_qr_attendance/public/kiosk.php
The kiosk displays only the scanner, organisation branding, camera status and attendance confirmation. It does not show the administration sidebar or management pages.
The person places their QR card inside the scanner frame. The browser reads the QR value and sends it to the attendance API. The system checks: Whether the QR format is valid, Whether the QR token exists, Whether it is the currently active QR token, Whether the person exists, Whether the person is active, Whether the current date is a holiday, Whether today is enabled in the assigned schedule, Whether the scan is inside the permitted window, Whether Time In already exists, and Whether Time Out already exists.
When no attendance record exists for that person, date and schedule, the first accepted scan records Time In. The system then calculates the attendance status. If the scan occurs before or within the allowed late threshold, the status is recorded as Present. If it occurs after the late threshold, it is recorded as Late.
When a Time In record already exists but Time Out is empty, the next accepted scan records Time Out. If both Time In and Time Out already exist, the scanner displays an attendance-completed message instead of creating another record.
After an accepted scan, the kiosk displays: Person’s photo, Full name, Person ID, Category, Department, Attendance status, Time In or Time Out, Recorded time, Schedule name, and a Success message. The scanner also provides success or error audio when scanner sounds are enabled.
Authorised users can open Attendance Logs to review records. When a genuine mistake occurs, an Administrator can correct the attendance time, status or remarks. The correction is recorded in the activity log.
Attendance records can be filtered by: Date range, Person, Category, Department, Status, Name, Person ID. Reports can be exported as PDF, Excel XLSX, CSV or a printable browser page.
The Super Administrator can create an SQL database backup from System Settings. Backups should be downloaded and stored outside the public website, especially before updates or major data changes.
The application contains three administrative user roles. Registered People are attendance subjects and do not automatically receive dashboard accounts.
The Super Administrator has the highest level of access. Typical permissions include viewing the complete dashboard, managing system users, creating Administrator and Staff accounts, managing people, managing categories, managing departments and groups, and managing attendance schedules. The Super Administrator can also generate and regenerate QR codes, operate the QR scanner, add manual attendance, correct attendance records, and view and export reports.
In addition, the Super Administrator can manage holidays and announcements, view notifications and activity logs, update organisation settings, configure the public kiosk, create database backups, download backups, and restore SQL backups.
The Administrator manages the organisation’s attendance operations. Typical permissions include viewing the dashboard, registering and updating people, managing categories, managing departments and groups, and managing schedules. The Administrator can also generate and print QR codes, operate the QR scanner, add manual attendance, correct attendance records, view attendance logs, and generate and export reports.
In addition, the Administrator can manage holidays and announcements and view activity logs. System-level functions such as backup, restore, and core application settings remain restricted to the Super Administrator.
Staff accounts are intended for daily attendance work. Typical access includes opening the QR scanner, scanning attendance, adding authorised manual attendance, viewing attendance logs, searching and filtering attendance, and viewing reports. Staff users can also read available announcements and notifications and view people, categories, departments, and schedules where required for operations. Staff users cannot manage system users, restore the database, or change restricted system settings.
A registered Person is not the same as an administrative user. People do not need a username and password to record attendance. Instead, they use their assigned QR card at the public attendance kiosk. The public kiosk does not provide access to dashboard analytics, people records, reports, user management, system settings, database backups, or manual attendance controls.
The system provides secure login, password hashing, role-based access control, and session regeneration after login. It also supports forgot-password tokens, password changes, user profiles, active and inactive user status, and login and logout activity history.
The dashboard displays the total number of registered people, today’s present count, today’s absent records, late count, Time In summary, Time Out summary, recent attendance, a seven-day attendance graph, and system announcements.
People management includes a unique Person ID, full name, photo upload, gender, birthdate, contact number, email, address, category, department or group, optional position or role, attendance schedule, and active or inactive status. The system also provides search and filtering and a paginated people list.
Category management allows users to add and edit categories, activate or deactivate categories, and delete unused categories. The system also supports default universal categories, category-based schedule assignment, and category attendance reports.
Department and group management includes adding departments or groups, department codes, parent and child grouping, editing departments, and activating or deactivating departments. The system also supports department-based schedule assignment and department attendance reports.
QR code management includes secure random QR tokens, QR image generation, QR preview, QR download, printable QR cards, and bulk QR card printing. The system can also generate missing QR images, regenerate QR codes, maintain QR version history, invalidate replaced QR codes, and validate QR codes.
The public attendance kiosk provides a separate public scanner page that does not require administrator login. It uses a responsive phone, tablet, and desktop layout, with automatic camera startup and a rear-camera preference on mobile. The kiosk includes an adaptive QR scanning frame, automatic Time In and Time Out, person photo confirmation, attendance status confirmation, success and error sounds, duplicate-read suppression, request throttling, and an optional kiosk access key. It also supports a configurable kiosk title, scanner location, and confirmation duration.
Attendance management supports QR attendance, manual attendance, Time In, Time Out, optional Break Out, and optional Break In. It also includes duplicate-attendance prevention, attendance correction, remarks, scanner location, device information, and attendance statuses such as Present, Late, Absent, On Leave, Holiday, and Half-Day.
Schedule management includes the schedule name, start time, end time, late threshold, allowed early-scan window, allowed late-scan window, and available weekdays. Schedules can be assigned to people, categories, and departments and can be set as active or inactive.
Attendance logs display the Person ID, QR-related identity, full name, category, department, schedule, date, Time In, Time Out, Break Out, Break In, status, remarks, and scanner location.
The system provides daily, weekly, monthly, and yearly attendance reports, as well as individual, department, category, late, and absent reports. Reports can be exported as PDF, Excel XLSX, or CSV files and can also be viewed in a print-friendly format. Report-generation activity is also recorded in an activity log.
The system provides in-app notifications, attendance alerts, low-attendance alerts, read and unread notification states, a mark-all-as-read option, and system announcements. It also records user action history, login history, QR-generation history, attendance-correction history, report-generation history, and backup and restore history.
System settings include the organization name, organisation logo, timezone, Person ID prefix, Person ID length, attendance rules, default late threshold, low-attendance threshold, QR size, QR prefix, scanner sound, kiosk status, kiosk title, kiosk location, and kiosk access key. The system also supports database backup, backup download, and SQL restore.
| Technology | Purpose | Version or requirement |
| PHP | Backend logic, routing, validation and services | 8.2 or newer |
| MySQL | Main relational database | 8.0+ |
| MariaDB | Alternative compatible database | 10.5+ |
| PDO MySQL | Secure database communication | PHP extension |
| HTML5 | Page and form structure | HTML5 |
| CSS | Responsive styling and kiosk layout | CSS3 |
| Bootstrap | Grid, forms, tables, buttons and responsive components | Bootstrap 4.x/4.6-compatible |
| AdminLTE | Administration dashboard interface | 3.2 |
| JavaScript | Scanner interaction and dynamic UI behaviour | ES6 |
| html5-qrcode | Browser and mobile camera QR scanning | 2.3.8 |
| Endroid QR Code | Server-side QR image generation | 6.x |
| Chart.js | Dashboard attendance charts | CDN build |
| Dompdf | PDF report generation | 3.1-compatible |
| PhpSpreadsheet | Excel XLSX export | 4.x or 5.x |
| SweetAlert2 | Confirmation and alert dialogs | CDN build |
| Composer | PHP dependency management | Composer 2 |
| Apache | Local web server | 2.4 recommended |
| XAMPP | Local PHP, Apache and database environment | Compatible release with PHP 8.2+ |
The project directly uses these technologies for attendance processing, QR generation, exports, reporting or interface behaviour. Libraries included only as dependencies of another package are not listed separately.
This QR Code Attendance Management System in PHP MySQL project follows a lightweight modular PHP structure rather than placing every operation in a single PHP file. The application is organised into separate areas for controllers, core functionality, services, views, configuration, database resources, public files, scripts and storage.
The authentication module manages all user authentication functions. It handles login and logout, password verification, forgot-password tokens, password resets and user session creation. It also manages role checking, profile updates and password changes.
The User and Role module manages the three administrative roles and their respective access levels. The roles table stores the role definitions, while the users table stores the administrative accounts associated with those roles.
The People module stores every attendee using a universal structure. It manages personal details, category, department, schedule, photo, status and Person ID, providing a central location for attendee information.
The QR Generation module is responsible for creating secure random tokens and generating QR images. It also stores different QR versions and invalidates replaced QR codes to ensure that outdated codes cannot continue to be used.
The Public Scanning module provides a separate scanner page for self-service attendance. It communicates with a restricted attendance API and operates independently from the administration layout.
The Attendance Processing module handles the main attendance business rules. It validates QR codes and people, checks holidays and resolves the applicable schedule. It also verifies active days and scan windows, calculates late status, records Time In and Time Out, and prevents duplicate attendance records.
The Reporting module retrieves filtered attendance information and generates reports in several formats. These include CSV files, XLSX spreadsheets, PDF reports and printable pages.
The Notification module provides in-app messages and attendance alerts. It also manages whether notifications have been read or remain unread.
The Activity Log module records important system actions for later review. This provides a history of relevant activities performed within the application.
System settings are stored in the database rather than being hardcoded throughout the application. This allows organisation details, attendance rules and kiosk behaviour to be updated directly through the dashboard without requiring changes throughout the application code.
The Backup and Restore module provides database backup and restoration functionality. The backup service creates SQL backups and supports controlled database restoration for the Super Administrator.
The database uses several relationships to keep information organised and maintain consistent links between the different parts of the system. One role can have many users, while one category can contain many people. Similarly, one department can contain many people, and a department may also have a parent department to support hierarchical department structures. A single schedule can be assigned to many categories, many departments and many individual people. This allows schedules to be applied at different levels depending on the organisation’s requirements.
Each person can have many historical QR-code records, allowing previous QR codes to be retained for reference while newer codes are issued. A person can also have many attendance records across different dates. Likewise, one schedule can be linked to many attendance records. The database also tracks which users create or update records. One user may create or update several records throughout the system. Notifications can be linked to a specific user or made available generally, depending on their purpose. Activity logs provide a record of important system actions. Each log may reference the user who performed the action, the action itself, the related entity and the corresponding record ID.
The attendance table uses a unique rule based on the person, attendance date and schedule. This ensures that the same person cannot have several attendance rows created for the same date and schedule. This uniqueness rule helps prevent duplicate attendance records and keeps attendance data consistent across the system.
We as the owner of this QR Code Attendance Management System in PHP MySQL project can confirm that the application was installed and working in a local environment. This Version package was also reviewed on 17 August 2026 for PHP syntax, route/controller consistency, kiosk JavaScript syntax and ZIP integrity. The exact local PHP, MySQL, XAMPP and browser patch versions used by the project owner were not recorded. For that reason, this documentation does not claim that every PHP 8.x release, hosting provider or browser has been personally tested.
The administration panel works in a modern JavaScript-enabled browser. The QR scanner additionally requires:
localhost access during local developmentChrome or Edge is recommended for initial testing. Camera behaviour should be tested on the exact phone, tablet or kiosk device that will be used.
The recommended installation uses the included web installer.
Download the complete Version ZIP package.
Extract it so the final folder name is:
universal_qr_attendanceAvoid creating an unnecessary nested folder such as:
universal_qr_attendance/universal_qr_attendance/Move the extracted folder to:
C:\xampp\htdocs\universal_qr_attendanceThe expected project structure should look similar to:
C:\xampp\htdocs\universal_qr_attendance\app
C:\xampp\htdocs\universal_qr_attendance\config
C:\xampp\htdocs\universal_qr_attendance\database
C:\xampp\htdocs\universal_qr_attendance\public
C:\xampp\htdocs\universal_qr_attendance\composer.jsonOpen Command Prompt or PowerShell inside the project folder.
Run:
cd C:\xampp\htdocs\universal_qr_attendance
composer install --no-dev --optimize-autoloaderThis installs the libraries used for:
After installation, the project should contain:
C:\xampp\htdocs\universal_qr_attendance\vendorOpen:
C:\xampp\php\php.iniConfirm that the required extensions are enabled.
Remove the leading semicolon where necessary:
extension=gd
extension=mbstring
extension=mysqli
extension=pdo_mysql
extension=zipDOM and Fileinfo are normally enabled by default in XAMPP.
Save the file and restart Apache.
The project also includes a requirements checker:
php scripts/check_requirements.phpRun it from:
C:\xampp\htdocs\universal_qr_attendanceOpen the XAMPP Control Panel. Start: Apache, MySQL. Both services should show a running status.
Open the following URL:
http://localhost/universal_qr_attendance/public/install.phpUse details suitable for your XAMPP installation. Typical local values are:
| Field | Local value |
| Database host | 127.0.0.1 |
| Database port | 3306 |
| Database name | universal_qr_attendance |
| Database user | root |
| Database password | <Leave blank for a default XAMPP installation> |
| Application URL | http://localhost/universal_qr_attendance/public |
The installer attempts to create the database when the MySQL user has permission. It then imports:
database/schema.sqlThe installer asks for: Administrator full name, Username, Email, Password. The password must contain at least eight characters. The system hashes the password before storing it.
The installer creates or selects universal_qr_attendance, Imports database/schema.sql , Adds the default roles, Adds the default categories, Adds the default settings, Creates the first Super Administrator, Creates the .env file
After installation, please open:
http://localhost/universal_qr_attendance/public/The direct login route is:
http://localhost/universal_qr_attendance/public/index.php?route=loginUse the username or email and password entered during installation.
This project does not contain a fixed public demo username or password. The first login account is created during installation. Example only:
Username: admin
Password: << the password you entered in install.php >>The default public kiosk URL is:
http://localhost/universal_qr_attendance/public/kiosk.phpThe exact kiosk URL is also displayed under:
System Settings → Public Attendance KioskAfter installation, delete or rename:
public/install.phpThis is especially important when the project is deployed online.
Use this method when the hosting account cannot create databases automatically.
Open phpMyAdmin and create:
universal_qr_attendanceUse UTF-8 MB4 where available.
Select the database and import:
database/schema.sqlCopy:
.env.exampleRename the copy to:
.envEdit .env:
APP_NAME="Universal QR Attendance"
APP_URL="http://localhost/universal_qr_attendance/public"
APP_ENV="local"
APP_DEBUG=true
APP_KEY="replace-this-with-a-long-random-secret"
DB_HOST="127.0.0.1"
DB_PORT="3306"
DB_NAME="universal_qr_attendance"
DB_USER="root"
DB_PASS=""The safest option is to use public/install.php after manually creating the empty database. Creating an administrator directly with SQL requires a valid PHP password_hash() value. Do not insert a plain-text password.
Run:
composer install --no-dev --optimize-autoloaderhttp://localhost/universal_qr_attendance/public/After the project has been installed, use it in the following order.
Use the account created during installation.
Open System Settings and enter:
Create Administrator or Staff / Operator accounts where required. Do not share one administrator account between several staff members if an audit trail is important.
Open Categories and add the attendee types used by the organisation. Examples include Student, Employee, Visitor and Volunteer.
Add the organisation’s departments, classes, courses, committees or teams.
Set the start time, end time, late threshold, scan window and available days. Assign the schedule to the relevant people, category or department.
Open People and add each attendee. Select their category, department, status and schedule.
Download or print each person’s QR code. Bulk card printing can be used when many people have been registered.
Open System Settings and enable the Public Attendance Kiosk. Set its location and optional access key.
On the shared device, open:
http://localhost/universal_qr_attendance/public/kiosk.phpAllow camera permission.
The person scans their QR code when arriving. The system records Time In and determines whether the attendance is Present or Late.
The person scans the same QR code again when leaving. The system records Time Out.
Open Attendance Logs to verify the recorded information. Use filters to find a specific person, date, department or status.
Use attendance correction when an authorised change is required. Add remarks explaining the correction.
Open Reports and select the report type, date range and filters. Export the result as PDF, XLSX, CSV or print.
Check attendance alerts, unread notifications, and recorded user actions.
Open System Settings and create an SQL backup. Download the backup and keep a copy outside the project folder.
Possible causes: MySQL is not running, the database username or password is incorrect, the database name is wrong, the host or port is wrong, or the PDO MySQL extension is missing.
Configuration file:
.envSolution: Start MySQL in XAMPP and confirm:
DB_HOST="127.0.0.1"
DB_PORT="3306"
DB_NAME="universal_qr_attendance"
DB_USER="root"
DB_PASS=""Also confirm that extension=pdo_mysql is enabled in php.ini.
Cause: Composer is not installed or is not available in the Windows PATH.
Solution: Install Composer 2 and reopen Command Prompt.
Test it using:
composer --versionThen run:
composer install --no-dev --optimize-autoloaderTypical error:
Failed opening required vendor/autoload.phpCause: Composer dependencies were not installed.
Solution: Open the project folder and run:
composer install --no-dev --optimize-autoloaderCause: The MySQL account does not have permission to create databases.
Solution: Create universal_qr_attendance manually in phpMyAdmin and run the installer again using the existing database.
Alternatively, import:
database/schema.sqlPossible causes: The wrong database is selected, the SQL file was imported twice, existing tables conflict, the server uses an unsupported database version, or phpMyAdmin upload limits are too low.
Solution: Use an empty universal_qr_attendance database and import:
database/schema.sqlThe project targets MySQL 8.0+ or MariaDB 10.5+.
Possible causes: Camera permission was denied, the site is running over plain HTTP on a remote domain, another application is using the camera, the browser does not support camera access, or the page is inside a restricted embedded frame.
Solution: Allow camera permission in the browser, use localhost during development, use HTTPS when deployed online, close other camera applications, test with Chrome or Edge, and reload the kiosk page.
Cause: Modern browsers normally require a secure context for camera access.
Solution: Install an SSL certificate and open the site through:
https://your-domain.example/Do not rely on plain HTTP for an online kiosk.
Possible causes: The GD extension is disabled, Composer dependencies are missing, or the QR upload directory is not writable.
Solution: Enable:
extension=gdRun Composer installation and confirm the QR storage directory has write permission.
Possible causes: The code belongs to another system, the QR prefix is incorrect, the person was deleted or made inactive, the QR was regenerated, or an old printed card is being used.
Solution: Open the person’s QR page and verify the active QR code.
Download or print the latest version.
Cause: The camera may read the same QR code several times while it remains inside the frame.
Solution: Remove the QR card after a successful scan.
The kiosk intentionally suppresses immediate repeated reads to prevent one scan from recording both Time In and Time Out.
Cause: Both Time In and Time Out have already been recorded for that person, date and schedule.
Solution: Review the Attendance Logs.
Use attendance correction only when the existing record is genuinely incorrect.
Cause: The current time is outside the schedule’s early or late scan allowance.
Solution: Review:
Possible causes: The application timezone is incorrect, the Windows/server time is incorrect, there is a PHP timezone difference, or there is a database server time difference.
Solution: Open System Settings and select the correct timezone. Also verify the operating system clock and server timezone.
Possible causes: The Dompdf dependency is missing, Composer was not run, required PHP extensions are unavailable, or large reports exceed server memory limits.
Solution: Run Composer installation and confirm DOM, Mbstring and related PHP extensions are enabled. Try a smaller report date range to identify memory-related problems.
Possible causes: PhpSpreadsheet is missing, the ZIP extension is disabled, or Composer dependencies were not installed.
Solution: Enable:
extension=zipThen run:
composer install --no-dev --optimize-autoloaderPossible causes: The upload directory is not writable, the file exceeds the PHP upload limit, the file type is unsupported, or the Fileinfo extension is disabled.
Solution: Check write permission for:
public/uploadsAlso review:
upload_max_filesize
post_max_sizeinside php.ini.
Possible causes: A required extension is missing, the PHP version is below 8.2, Composer dependencies are missing, or a fatal PHP error is hidden in production mode.
Development-only troubleshooting: Temporarily edit .env:
APP_ENV="local"
APP_DEBUG=trueDo not leave debug mode enabled on a public website. Check the PHP or Apache error log for the real message.
Possible causes: Apache rewrite is disabled, .htaccess is ignored, the project URL is incorrect, or the web root is not pointing to public.
Solution: Enable Apache mod_rewrite and allow .htaccess overrides.
For simple local access, use the direct route format:
http://localhost/universal_qr_attendance/public/index.php?route=loginCause: The project uses PHP’s configured mail() transport. A default XAMPP installation usually does not send internet email without additional mail configuration.
Solution: Configure an SMTP or mail service for production.
In a local development environment, reset links may also be written to:
storage/logs/password-reset.logPossible causes: The backup directory is not writable, database credentials are incorrect, PHP execution limits are too low, or the database is large.
Solution: Check:
public/backupsMake sure the server can write to it and verify the database connection. For large production databases, use a server-level backup process instead of relying only on the browser.
This project includes several security measures, but it should still be reviewed before being used by a real organisation.
The application includes:
The project is suitable for:
It should not be described as automatically production-ready simply because it runs successfully on XAMPP. Before production use, an experienced developer should review:
There are no fixed default credentials in the package. The first Super Administrator is created through the installer. This is safer than including the same public password in every downloaded copy.
The public kiosk requires browser camera permission. Camera access may fail when:
A QR code proves that the code was scanned. It does not prove that the registered person was physically holding it. A person could photograph, copy or share their QR code with someone else. Organisations requiring stronger identity confirmation should consider additional controls such as:
These controls are not included in this version.
The kiosk can use an optional access key, but a URL key alone is not a replacement for full device authentication. The kiosk should be opened on a controlled device and should not be published unnecessarily.
The kiosk includes request throttling and repeated-code suppression. The current protection is application/session based. It is not a distributed rate-limiting system for multiple application servers. A production deployment may require web-server, firewall or reverse-proxy rate limiting.
HTTPS is strongly recommended for the complete application and normally required for browser camera access outside localhost.
The system can store:
The organisation using the project is responsible for obtaining consent, limiting access, defining retention periods and complying with local privacy laws. Only necessary personal information should be collected.
Backups may contain the complete attendance database. Backup files should not remain publicly accessible. For production use:
public/backupsForgot-password delivery uses PHP’s configured mail transport. SMTP configuration is not included as a full dashboard module.
AdminLTE, Bootstrap-related assets, Chart.js, SweetAlert2 and html5-qrcode are loaded through CDN links. An offline intranet deployment should download these assets and serve them locally.
Registered People do not receive personal login accounts in this version. They can scan attendance through the public kiosk, but they cannot sign in to view their personal attendance history.
The system supports Absent status and absent reports, but Version 1.1.1 does not include a server scheduler that automatically marks every unscanned person absent at the end of the day. Absent records can be managed according to the organisation’s attendance process.
Yes. The system does not hardcode attendees as students or employees. Every attendee is stored as a Person and assigned to a configurable category. This means the same installation can manage students, employees, faculty members, visitors, contractors, volunteers, members and guests.
The scanner is designed to work with modern mobile browsers that support camera access. The responsive kiosk includes a mobile layout and prefers the rear-facing camera. Chrome or Edge is recommended for initial testing. The website must use HTTPS when it is deployed online. Localhost can normally access the camera without a public SSL certificate. Because camera support varies between browsers and devices, test the actual phone or tablet before using it as a permanent kiosk.
Yes. People scan their own QR codes using the separate public kiosk:
http://localhost/universal_qr_attendance/public/kiosk.phpThey do not need an Administrator or Staff account. The kiosk only displays the camera scanner and attendance result. It does not provide access to the administration dashboard.
Yes. The first accepted scan records Time In. The next accepted scan records Time Out. When both values already exist, another automatic scan is rejected as completed attendance. The authenticated scanner also supports optional Break Out and Break In actions.
The assigned schedule contains:
The attendance service compares the Time In with the schedule start plus the threshold. A scan after that calculated time is marked Late.
Yes. The database prevents duplicate attendance rows for the same person, date and schedule.
The scanner also checks whether Time In and Time Out already exist. The public kiosk suppresses immediate repeated reads of the same QR code so one card held in front of the camera does not instantly create both actions.
The minimum supported version is:
PHP 8.2The Composer configuration also requires PHP 8.2 or newer.
Yes. The complete SQL schema is included at:
database/schema.sqlThe default database name is:
universal_qr_attendanceThe web installer can create and import the database automatically when the database user has sufficient permission.
No fixed demo credentials are included. The installer simply asks you to create the first Super Administrator account. Use the username or email and password entered during installation.
No. When the QR code is regenerated, the previous active QR token is disabled. The person must use the newly generated QR card.
The system supports Absent records and absent reports. However, this current version of the project does not include a scheduled background task that automatically marks every person absent after a schedule ends. The organisation should manage absent status according to its own attendance process.
Yes. It covers several practical development areas:
The project can be studied, demonstrated and extended as an attendance-management case study. Before using it with real personal data, review the security, privacy and deployment limitations described above.
You can download the complete QR Code Attendance Management System in PHP and MySQL using the button below. The download package includes the complete PHP source code, MySQL database file, AdminLTE interface, QR attendance scanner, public attendance kiosk and the project files required for local installation.
Before installing the project, check the System Requirements and Installation Guide provided above. The project is supplied as a ZIP file and can be installed locally using XAMPP or on a compatible PHP and MySQL web server.
Note: This project is provided for educational, learning and development purposes. Review the source code, security settings and server configuration carefully before using it with real organisational or personal data.
Looking for more PHP projects?
Browse more PHP MySQL projects with source code for programming practice, academic projects and web development examples.
Online Job Portal Project in PHP MySQL with Source Code is a web-based application designed…
A fully functional project based on a Real Estate Website which is developed using the…
A fully functional project based on a membership management system that uses PHP Language with MySQL…
A fully functional project based on a clinic management system that uses PHP Language with Laravel…
A fully functional project based on a sales and invoice management system that uses PHP Language…
A fully functional project based on POS and Inventory Management System which uses PHP Language with CodeIgniter Web…
This website uses cookies.