安全登录代码 php,安全登录php脚本

我做了一个登录系统,其中插入的_id和插入的_密码被发送到

login.inc.php

XMLHttpRequest

. 我不确定我的php脚本是否安全。我需要一些关于我的剧本的安全建议。

login.inc.php:

session_start();

$conn = mysqli_connect("localhost", "root", "", "users");

$params = json_decode(file_get_contents('php://input'), true);

$inserted_id = $params['inserted_id'];

$inserted_password = $params['inserted_password'];

$stmt = mysqli_stmt_init($conn);

if (mysqli_stmt_prepare($stmt, "SELECT * FROM user WHERE account_name=? OR email=?;")) {

mysqli_stmt_bind_param($stmt, "ss", $inserted_id, $inserted_id);

mysqli_stmt_execute($stmt);

$row = mysqli_fetch_assoc(mysqli_stmt_get_result($stmt));

if ($row == null) {

echo ("DOESNT EXISTS");

} else {

if (password_verify($inserted_password, $row['password'])) {

$_SESSION['user_id'] = $row['id'];

echo("SUCCESS");

} else {

echo("PASSWORD_FAIL");

}

}

}

?>

signup.inc.php:

$conn = mysqli_connect("localhost", "root", "", "users");

$params = json_decode(file_get_contents('php://input'), true);

$inserted_first_name = $params['first_name'];

$inserted_last_name = $params['last_name'];

$inserted_dob = $params['dob'];

$inserted_email = $params['email'];

$inserted_account_name = $params['account_name'];

$inserted_password = $params['password'];

$stmt = mysqli_stmt_init($conn);

if (mysqli_stmt_prepare($stmt, "SELECT * FROM user WHERE email=?;")) {

mysqli_stmt_bind_param($stmt, "s", $inserted_email);

mysqli_stmt_execute($stmt);

if (mysqli_num_rows(mysqli_stmt_get_result($stmt)) > 0) {

echo("EMAIL_TAKEN");

} else {

$hashed_password = password_hash($inserted_password, PASSWORD_DEFAULT);

$created_id = rand(111111111, 999999999);

$stmt = mysqli_stmt_init($conn);

if (mysqli_stmt_prepare($stmt, "INSERT INTO user(id, first_name, last_name, dob, email, account_name, password) VALUES (?, ?, ?, ?, ?, ?, ?);")) {

mysqli_stmt_bind_param($stmt, "issssss", $created_id, $inserted_first_name, $inserted_last_name, $inserted_dob, $inserted_email, $inserted_account_name, $hashed_password);

$result = mysqli_stmt_execute($stmt);

echo ($result ? "SUCCESS" : "FAIL");

}

}

mysqli_stmt_close($stmt);

}

?>