PDO Login/Register system review

Question

I wrote my very first login/register PDO system today. I know there is still a lot of flaws, but I was wondering what tips and advice you have to help me improve this. I know that PDO is much more secure than MySQl, so would you say my code is secure? If so, to what extent, since I'm using PDO? Any tips and advice would be much appreciated!

login.php

<h1>Login</h1>
<form method="POST">
    <input type="text" name="username"><br />
    <input type="password" name="password"><br />
    <input type="submit">
</form>

<?php
session_start();
    if(isset($_POST['username'], $_POST['password'])){
        require 'core/connect.php';

        $query = dbConnect()->prepare("SELECT username, password FROM users WHERE username=:username AND password=:password");
        $query->bindParam(':username', $_POST['username']);
        $query->bindParam(':password', $_POST['password']);
        $query->execute();

        if($row = $query->fetch()){
            $_SESSION['username'] = $row['username'];
            header("Location: index.php");
        }
    }
?>

register.php

<h1>Register</h1>
<form method="POST">
    <input type="text" name="username"><br />
    <input type="password" name="password"><br />
    <input type="submit">
</form>

<?php
session_start();

    if(isset($_POST['username'], $_POST['password'])){
        require 'core/connect.php';

        $query = dbConnect()->prepare("INSERT INTO users (username, password) VALUES (:username, :password)");
        $query->bindParam(':username', $_POST['username']);
        $query->bindParam(':password', $_POST['password']);

        if($query->execute()){
            header("Location: index.php");
        } else{
            echo 'ERROR';
        }
    }
?>

index.php

<?php
session_start();

if(isset($_SESSION['username'])){
    echo 'Welcome!', '<a href="logout.php">Logout</a>';
} else {
    echo '<a href="login.php">Login</a><br />
    <a href="register.php">Register</a>';
}
?>

core/connect.php

<?php
    function dbConnect(){
        try{
            $username = 'root';
            $password = '';
            $conn = new pdo("mysql:host=localhost;dbname=test;", $username, $password);
            $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
            return $conn;

        }   catch(PDOException $e){
            echo 'ERROR', $e->getMessage();
        }
    }
?>

Answer 1

Here are several tips:

• Use OOP - this way you could start the session only once
• Hash your passwords - this way no one can steal it from the db, or at least the chance is lower
• Use MVC - separate your HTML from the PHP code
• Move your db connect credentials to the .ini file - this way it could be easily changed and .ini files can be cached by the server

Feel free to check my code for user authorization here in my pet project.