Registration and Login System for Application I am developing a social platform and currently just completed the registration and login PHP pages. The application is an android application
that authenticates against a MySQL DB. I am seeking critiques on how "safe" and correct my PHP pages are that I am authenticating against, IE: Am I storing and authenticating passwords in a safe manner. This is my first try so I am up for changes. 

Registration Page

&lt;?php
define('HOST', 'localhost');
define('USER', 'admin');
define('PASS', 'password');
define('DB', 'database');
$con = mysqli_connect(HOST, USER, PASS, DB);

$username = $_POST["username"];
$password = $_POST["password"];
$email = $_POST["email"];
$age = $_POST["age"];
$id = $_POST["id"];
$hash = password_hash($password, PASSWORD_DEFAULT);

$sql = "INSERT INTO `table` (Username,Password,Email) values
       ('$username','$hash','$email')";

if (mysqli_query($con, $sql)) {
$response["success"] = 1;
$response["message"] = "Success";
die(json_encode($response));
} else {

$response["success"] = 0;
$response["message"] = "Invalid ";
die(json_encode($response));
}
mysql_close();
php
?&gt;


Login Auth

&lt;?php
define('HOST', 'localhost');
define('USER', 'admin');
define('PASS', 'password');
define('DB', 'database');
mysql_connect(HOST, USER, PASS);
mysql_select_db(DB)or die;
$username = $_POST["username"];
$password = $_POST["password"];

if (!empty($_POST)) {
if (empty($_POST['username']) || empty($_POST['password'])) {
    // Create some data that will be the JSON response 
    $response["success"] = 0;
    $response["message"] = "One or both of the fields are empty .";
    die(json_encode($response));
}
$query = "SELECT * FROM `table` WHERE `Username` = '$username' LIMIT 1";
$result = mysql_query($query) or die(mysql_error());
$row = mysql_fetch_array($result);
$hash = $row["Password"];
if (password_verify($password, $hash)) {
    $response["success"] = 1;
    $response["message"] = "You have been sucessfully login";
    die(json_encode($response));
} else {

    $response["success"] = 0;
    $response["message"] = "invalid username or password ";
    die(json_encode($response));
}
} else {

$response["success"] = 0;
$response["message"] = " One or both of the fields are empty ";
die(json_encode($response));
}
mysql_close();


Any input or information to make this better/more functional is greatly appreciated.
Security

Yes, you are storing passwords safely. But your code is still incredibly insecure, as you are completely open to SQL injection.

You should use prepared statements, always, for all variable data.

[I also don't see any protection against CSRF; If you don't have it, you should add it, even for login forms; A user may for example force-login a victim into a fake account, and - if the victim does not pay attention - the attacker can thus see actions the victim takes on the site (which may potentially be interesting on a social platform and would definitely violate the privacy of your users)]

Misc

There are a lot of small mistakes and oddities in your code which makes it harder to read and maintain than necessary. Here's a small list, although I may have missed some.


Your indentation is off, making your code hard to read.
You mix mysql_ and mysqli_ functions, which will not work. 
Do not use mysql_ functions; they are deprecated and will be removed in PHP7.
You have statements after you die (eg mysql_close();), which doesn't make sense.
Why die? There are few reasons to do it (one would be after a redirect), but in your cases it doesn't really make sense.
You have some duplication which you should remove (eg the One or both of the fields are empty error parts; You also have a lot more die(json_encode($response)); than you need).
I would use a lot more functions. It makes code more readable (because logical blocks now have a name) and more reusable and testable.
Why do you have POST values that you don't use (eg age, id)? 
You define your db info more than once, which makes your code hard to maintain. It also makes hiding your db password harder.
You first access POST, and only afterwards ask if POST is empty or not (and you only actually check this in your login code, not your registration code).