php ajax 登录提示,PHP AJAX登录,这种方法安全吗？

我刚刚启动

PHP和mySQL,需要知道这是否“安全”.登录信息通过AJAX(jQuery)传递到以下PHP文件中.

jQuery AJAX

$("#login_form").submit(function(){

$.post("login.php",{user:$('#username').val(),pass:$('#password').val()} ,function(data)

PHP

ob_start();

mysql_connect("-", "-", "-") or die("ERROR. Could not connect to Database.");

mysql_select_db("-")or die("ERROR. Could not select Database.");

//Get Username and Password, md5 the password then protect from injection.

$pass = md5($pass);

$user = stripslashes($user);

$pass = stripslashes($pass);

$user = mysql_real_escape_string($user);

$pass = mysql_real_escape_string($pass);

//See if the Username exists.

$user_result=mysql_query("SELECT * FROM users WHERE username='$user'");

$user_count=mysql_num_rows($user_result);

if($user_count==1){

if($pass_length==0){ echo "userVALID"; }

else{

$pass_result=mysql_query("SELECT * FROM users WHERE username='$user' and password='$pass'");

$pass_count=mysql_num_rows($pass_result);

if($pass_count==1){

session_register("user");

session_register("pass");

echo "passVALID";

}

else { echo "passERROR"; }

}

}

else { echo "userERROR"; }

ob_end_flush();

我知道这可能不是最好的做事方式,但这是我所知道的方式！我只是想知道它是否有任何重大的安全漏洞.这对我来说更像是一个概念,因此我没有加入SSL.