Login/registration part of an Android application I made some PHP files for the login/registration part of my Android application and I would like to know if it can be made safer.

config.php:

&lt;?php

    define('hostname', 'localhost');
    define('username', 'alexiz');
    define('password', '12qwas!@QWAS');
    define('db_name', 'shhaapp_db');

?&gt;


connection.php:

&lt;?php

    require_once 'config.php';

    class DB_Connection {

        private $connect;
        function __construct() {
            $this-&gt;connect = mysqli_connect(hostname, username, password, db_name) or die(" DB connection error");
        }

        public function get_connection() {
            return $this-&gt;connect;
        }

    }

?&gt;


register.php:

&lt;?php

    require_once 'connection.php';
    header('Content-Type: application/json');

    class User {

        private $db;
        private $connection;

        function __construct() {
            $this-&gt;db = new DB_Connection();
            $this-&gt;connection = $this-&gt;db-&gt;get_connection();
        }

        public function registration($email,$username,$password) {
            $query = "INSERT INTO users(email,username,password) VALUES ('$email','$username','$password')";
            $is_inserted = mysqli_query($this-&gt;connection, $query);
            if ($is_inserted == 1) {
                $json['success'] = 'account for '.$username.' was created';
            } else {
                $json['error'] = 'email or username is already taken';
            }
            echo json_encode($json);
            mysqli_close($this-&gt;connection);
        }

    }

    $user = new User();
    if (isset($_POST['email'],$_POST['username'],$_POST['password'])) {
        $email = $_POST['email'];
        $username = $_POST['username'];
        $password = $_POST['password'];

        if (!empty($email) &amp;&amp; !empty($username) &amp;&amp; !empty($password)) {
            $encrypted_password = md5($password);
            $user -&gt; registration($email,$username,$encrypted_password);
        } else {
            $json['error'] = 'please fill in all fields';
            echo json_encode($json);
        }
    }

?&gt;


login.php:

&lt;?php

    require_once 'connection.php';
    header('Content-Type: application/json');

    class User {

        private $db;
        private $connection;

        function __construct() {
            $this-&gt;db = new DB_Connection();
            $this-&gt;connection = $this-&gt;db-&gt;get_connection();
        }

        public function login($username,$password) {
            $query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
            $result = mysqli_query($this-&gt;connection, $query);
            if (mysqli_num_rows($result) &gt; 0) {
                $json['success'] = 'welcome '.$username;
            } else {
                $json['error'] = 'incorrect username or password';
            }
            echo json_encode($json);
            mysqli_close($this-&gt;connection);
        }

    }

    $user = new User();
    if (isset($_POST['username'],$_POST['password'])) {
        $username = $_POST['username'];
        $password = $_POST['password'];

        if (!empty($username) &amp;&amp; !empty($password)) {
            $encrypted_password = md5($password);
            $user -&gt; login($username, $encrypted_password);
        } else {
            $json['error'] = 'you must fill out all fields';
            echo json_encode($json);
        }
    }

?&gt;
Security

You are completely open to SQL injection (in your login as well as registration page). You should always use prepared statements.

Also, md5 is not good enough, use bcrypt.

Misc


class files should not have side effects as it makes it hard to reuse them. Just create a file called user.php and place the class - and nothing else - inside it.