Hello I am a beginner in PHP and I need some opinions. How secure is my registration code ? If I launched this on the web would you feel safe signing up with personal info ?
<?php
// shows all errors
ini_set('display_errors', 1);
error_reporting(E_ALL);
//check if form is submitted
if ( $_SERVER['REQUEST_METHOD'] != 'POST' || ! isset($_POST['Register']))
{
// looks like a hack, send to index.php
header('Location: index.php');
die();
}
include("connect.php");
$errors = [];
if (empty($_POST["username"])) {
$errors[] = "Fill in username to sign up";
}
if (empty($_POST["pw"])) {
$errors[] = "Fill in password to sign up";
}
if (empty($_POST["pw2"])) {
$errors[] = "Confirm password to sign up";
}
// and so on...
if ($_POST['pw'] !== $_POST['pw2']) {
$errors[] = "The passwords do not match.";
}
if (!$errors) {
$stmt = $conn->prepare("SELECT * FROM users WHERE username=?");
$stmt->bind_param("s", $_POST['username']);
$stmt->execute();
$row = $stmt->get_result()->fetch_assoc();
if ($row && $row['username'] == $_POST['username']) {
$errors[] = "Username exists";
}
}
if (!$errors) {
$pw = password_hash($_POST['pw'], PASSWORD_BCRYPT, array('cost' => 14));
$stmt = $conn->prepare("INSERT INTO users (username, pw) VALUES(?, ?)");
$stmt->bind_param("ss", $_POST['username'], $pw );
$stmt->execute();
echo "Registration successful <a href= index.php>Login here</a><br />";
} else {
foreach ($errors as $error) {
echo "$error <br /> \n";
}
echo '<a href="index.php">Try again</a><br />';
}
?>