I wrote my very first login/register PDO system today. I know there is still a lot of flaws, but I was wondering what tips and advice you have to help me improve this. I know that PDO is much more secure than MySQl, so would you say my code is secure? If so, to what extent, since I'm using PDO? Any tips and advice would be much appreciated!
login.php
<h1>Login</h1>
<form method="POST">
<input type="text" name="username"><br />
<input type="password" name="password"><br />
<input type="submit">
</form>
<?php
session_start();
if(isset($_POST['username'], $_POST['password'])){
require 'core/connect.php';
$query = dbConnect()->prepare("SELECT username, password FROM users WHERE username=:username AND password=:password");
$query->bindParam(':username', $_POST['username']);
$query->bindParam(':password', $_POST['password']);
$query->execute();
if($row = $query->fetch()){
$_SESSION['username'] = $row['username'];
header("Location: index.php");
}
}
?>
register.php
<h1>Register</h1>
<form method="POST">
<input type="text" name="username"><br />
<input type="password" name="password"><br />
<input type="submit">
</form>
<?php
session_start();
if(isset($_POST['username'], $_POST['password'])){
require 'core/connect.php';
$query = dbConnect()->prepare("INSERT INTO users (username, password) VALUES (:username, :password)");
$query->bindParam(':username', $_POST['username']);
$query->bindParam(':password', $_POST['password']);
if($query->execute()){
header("Location: index.php");
} else{
echo 'ERROR';
}
}
?>
index.php
<?php
session_start();
if(isset($_SESSION['username'])){
echo 'Welcome!', '<a href="logout.php">Logout</a>';
} else {
echo '<a href="login.php">Login</a><br />
<a href="register.php">Register</a>';
}
?>
core/connect.php
<?php
function dbConnect(){
try{
$username = 'root';
$password = '';
$conn = new pdo("mysql:host=localhost;dbname=test;", $username, $password);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
return $conn;
} catch(PDOException $e){
echo 'ERROR', $e->getMessage();
}
}
?>