Security of login and register system
As others have mentioned, use the PDO library for database work and there is no reason to use gobals. Another thing I would highly recommend, is to use exceptions, they're amazing. I'm glad to see you using the password_* library though.

I have wrote a simple authentication class to get you started, and should by no means be used in a production environment.

class Auth
{
    private $dbh;
    private $config;
    private $user;

    public function __construct(PDO $dbh, array $config = array())
    {
        $this-&gt;dbh = $dbh;
        $this-&gt;config = $config;
        session_start();

        if ($this-&gt;isLoggedIn()) {
            $this-&gt;user = $this-&gt;getLoggedInUser();
        }
    }

    public function login($username, $password)
    {
        // check if user is already logged in

        // now validate your input data

        $user = $this-&gt;findUserByUsername($username);
        var_dump($user);

        if ($user) {
            if (password_verify($password, $user-&gt;password)) {
                $_SESSION['username'] = $user-&gt;username;
                $this-&gt;user = $user;

                return true;
            }

            throw new Exception('The password is incorrect');
        }

        throw new Exception("The username {$username} could not be found");
    }

    public function register(array $data)
    {
        // data validation goes here

        if ($data['password'] !== $data['password_again']) {
            throw new Exception("The passwords do not match");
        }

        if ($this-&gt;findUserByUsername($data['username'])) {
            throw new Exception('The username ' . $data['username'] . ' already exists');
        }

        $hash = password_hash($data['password'], PASSWORD_BCRYPT, array('cost' =&gt; 11));
        $sql = 'INSERT INTO users(username, password) VALUES (:username, :password)';

        $stmt = $this-&gt;dbh-&gt;prepare($sql);
        $stmt-&gt;bindParam(':username', $data['username'], PDO::PARAM_STR);
        $stmt-&gt;bindParam(':password', $hash, PDO::PARAM_STR);
        $result = $stmt-&gt;execute();

        if ($result) {
            $this-&gt;login($data['username'], $data['password']);

            return true;
        }

        throw new Exception('Something went seriously wrong');
    }

    public function logout()
    {
        if ($this-&gt;isLoggedIn()) {
            unset($_SESSION['username']);

            return true;
        }

        return false;
    }

    public function isLoggedIn()
    {
        return array_key_exists('username', $_SESSION);
    }

    public function getLoggedInUser()
    {
        if ($this-&gt;user === null) {
            $this-&gt;user = $this-&gt;findUserByUsername($_SESSION['username']);
        }

        return $this-&gt;user;
    }

    protected function findUserByUsername($username)
    {
        $stmt = $this-&gt;dbh-&gt;prepare('SELECT * FROM users WHERE username = :username');
        $stmt-&gt;bindParam(':username', $username, PDO::PARAM_STR);
        $stmt-&gt;execute();

        return $stmt-&gt;fetch(PDO::FETCH_OBJ);
    }
}

$dbh = new PDO('mysql:host=localhost;dbname=test', 'root', '');
$auth = new Auth($dbh);

try {

    // login example
    //$auth-&gt;login($_POST['username'], $_POST['password']);

    // register example
    //$auth-&gt;register($_POST);

} catch (Exception $e) {

    die($e-&gt;getMessage());
}

// logout
if (isset($_GET['logout'])) {
    $auth-&gt;logout();
}

// check if logged in
if ($auth-&gt;isLoggedIn()) {
    $username = $auth-&gt;getLoggedInUser()-&gt;username;

    echo '&lt;p&gt;Welcome &lt;a href=#' . $username . '&gt;' . ucfirst($username) . '&lt;/a&gt;&lt;/p&gt;';
    echo '&lt;p&gt;&lt;a href="?logout"&gt;Logout&lt;/a&gt;&lt;/p&gt;';
}