I wrote my very first login/register PDO system today. I know there is still a lot of flaws, but I was wondering what tips and advice you have to help me improve this. I know that PDO is much more secure than MySQl, so would you say my code is secure? If so, to what extent, since I'm using PDO? Any tips and advice would be much appreciated!

<h1>Login</h1>
<form method="POST">
<input type="submit">
</form>

<?php
session_start();
if(isset($_POST['username'],$_POST['password'])){
require 'core/connect.php';

$query = dbConnect()->prepare("SELECT username, password FROM users WHERE username=:username AND password=:password");$query->bindParam(':username', $_POST['username']);$query->bindParam(':password', $_POST['password']);$query->execute();

if($row =$query->fetch()){
$_SESSION['username'] =$row['username'];
}
}
?>


register.php

<h1>Register</h1>
<form method="POST">
<input type="submit">
</form>

<?php
session_start();

if(isset($_POST['username'],$_POST['password'])){
require 'core/connect.php';

$query = dbConnect()->prepare("INSERT INTO users (username, password) VALUES (:username, :password)");$query->bindParam(':username', $_POST['username']);$query->bindParam(':password', $_POST['password']); if($query->execute()){
} else{
echo 'ERROR';
}
}
?>


index.php

<?php
session_start();

if(isset($_SESSION['username'])){ echo 'Welcome!', '<a href="logout.php">Logout</a>'; } else { echo '<a href="login.php">Login</a><br /> <a href="register.php">Register</a>'; } ?>  core/connect.php <?php function dbConnect(){ try{$username = 'root';
$password = '';$conn = new pdo("mysql:host=localhost;dbname=test;", $username,$password);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); return$conn;

}   catch(PDOException $e){ echo 'ERROR',$e->getMessage();
}
}
?>


Here are several tips:

• Use OOP - this way you could start the session only once
• Hash your passwords - this way no one can steal it from the db, or at least the chance is lower
• Use MVC - separate your HTML from the PHP code
• Move your db connect credentials to the .ini file - this way it could be easily changed and .ini files can be cached by the server

Feel free to check my code for user authorization here in my pet project.

• – t1gor Jan 17 '14 at 17:23
• – t1gor Jan 17 '14 at 17:23
• @user3121014 I would appreciate if you could tick the answer if it helped. – t1gor Sep 6 '17 at 7:53

## protected by Jamal♦Oct 26 '16 at 19:04

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).