PHP mysqli code for login form Can you check my code if I wrote like a professional?


connection page.
form sign page.
plan page.
log out page.


First I create the database and tables, then the connection file, then the form sign in page, then the plan page, finally the log out page

Database educate (create table users):

CREATE TABLE users(
id INT AUTO_INCREMENT,
username VARCHAR(50) NOT NULL,
password VARCHAR(100) NOT NULL,
PRIMARY KEY(id)
);


Conection.php:

&lt;?php
$servername = 'localhost';
$username = 'root';
$password = '';
$db = 'educate';
//I added @ to delete error message that comming from  MySQL 
$conn = @new mysqli($servername,$username,$password,$db);
if($conn-&gt;connect_error) die('Connection faild');
?&gt;


Form signin.php:

&lt;?php
//Check the cookie
if(!empty($_COOKIE['user'])) { header ('location: plan.php'); }
?&gt;

&lt;?php
//Check the inputs
function test_input($data) {
$data = trim($data);  
//return a $data with whitespace stripped from the beginning and end of    
$data
$data = stripslashes($data); //emoves backslashes
$data = htmlspecialchars($data); 
//converts some predefined characters to  HTML entities
return $data;
}
?&gt;

&lt;?php
$username = $password = $password_hash = '';
$usernameErr = $passwordErr = '';

//Connection file
require ('connection.php');

if($_SERVER['REQUEST_METHOD'] == 'POST'){

if(empty($_POST['username'])){
$usernameErr = 'Username cannot be empty';
}else{
$username = test_input($_POST['username']);
}

if(empty($_POST['password'])){
$passwordErr = 'Password cannot be empty';
}else{
$password = test_input($_POST['password']);
$password_hash = md5($password);
}



//Select the data from DB('educate')
$sql = " SELECT username, password FROM users WHERE username='$username' 
AND  password='$password_hash' ";

$result = $conn-&gt;query($sql);

if($result-&gt;num_rows === 0) {
$usernameErr = 'Username is error';
$password = 'Password is error';
} elseif($result-&gt;num_rows === 1) {
//Set cookie (one hour) and moved to  another    page
SETCOOKIE('user', $username, time() + (60*60) );
header('location: plan.php');
}


}
?&gt;

&lt;form action="#" method="post"&gt;
Username: &lt;input type="text" name="username" placeholder="username"&gt; 
&lt;?php echo $usernameErr; ?&gt;
&lt;br/&gt;&lt;br/&gt;
Password: &lt;input type="password" name="password" placeholder="password"&gt;
&lt;?php echo $passwordErr; ?&gt;
&lt;br/&gt;&lt;br/&gt;
&lt;input type="submit" value="Login"&gt;
&lt;/form&gt;


Logout.php:

&lt;?php
setcookie('user',"", time() - (30*30) );
header('location: form signin.php');
?&gt;
Did you know that anyone can set a cookie whenever they like? Imagine someone will set the "user" cookie to "admin".

Use any of popular PHP frameworks instead. They're here for a reason.

I'd also advise to use prepared statement if you absolutely have to write this kind of code yourself.

$query = "SELECT username, password FROM users WHERE username=? AND password=?";
if ($pst = $conn-&gt;prepare($query)) {
  $pst-&gt;bind_param("ss", $username, $password_hash);
  $pst-&gt;execute();
  if ($pst-&gt;num_rows) { 
    // logged in
  }
}