Security of login and register system I need some help with my register and log in functions. I'm not sure if I have understood bcrypt correctly either. I'm doubting the security of it, what do you think?

Is this good, or are there any changes I should make? Have I missed anything?

For the database table users, I created (ID, username and password[char:60]):

function loginAccount() {
    global $connect;

    $username = mysqli_real_escape_string($connect, $_POST['username']);
    $password = mysqli_real_escape_string($connect, $_POST['password']);

    $existingHashFromDb = "";
    if(!isset($existingHashFromDb)) {
        // existing password from database is not set
    } else {

        $login_sql = "SELECT password FROM users WHERE username = '".$username."'";
        $login_result = mysqli_query($connect, $login_sql);

        if($login_result) {
            while($row = mysqli_fetch_assoc($login_result)) {
                $existingHashFromDb = $row['password'];
            }

            # Check if the hash of the entered login password, matches the stored hash.
            # The salt and the cost factor will be extracted from $existingHashFromDb.
            $isPasswordCorrect = password_verify($password, $existingHashFromDb);

            if($isPasswordCorrect) {
                // you are logged in
                echo "&lt;p&gt;Welcome &lt;a href=\"#{$username}\"&gt;" . ucfirst($username) . "&lt;/a&gt;&lt;/p&gt;";

                // logout?
                echo "&lt;p&gt;&lt;a href=\"?logout\"&gt;Logout&lt;/a&gt;&lt;/p&gt;";
            } else {
                echo "&lt;p&gt;Password did not match.&lt;/p&gt;";
            }
        } else {
            // query failed
            mysqli_free_result($login_result);
            mysqli_close($connect);
        }

    }

}

function registerAccount() {
    global $connect;

    $username       = mysqli_real_escape_string($connect, $_POST['username']);
    $password       = mysqli_real_escape_string($connect, $_POST['password']);
    $password_again = mysqli_real_escape_string($connect, $_POST['password_again']);


    # This way you can define a cost factor (by default 10). Increasing the
    # cost factor by 1, doubles the needed time to calculate the hash value.
    $hashToStoreInDb = password_hash($password, PASSWORD_BCRYPT, array("cost" =&gt; 11));

    # See if the username already exists in the database
    $userexist_query = "SELECT username FROM users WHERE username = '".$username."'";
    $userexist_result = mysqli_query($connect, $userexist_query);

    if($userexist_result) {
        if(mysqli_num_rows($userexist_result) &gt;= 1) {
            echo "&lt;p&gt;Username already exists!&lt;/p&gt;";
        } else {
            # See if the password and password_again is matching.
            if($password == $password_again) {
                $register_query  = "INSERT INTO users (username, password) VALUES ('$username', '$hashToStoreInDb')";
                $register_result = mysqli_query($connect, $register_query);

                if($register_result) {
                    echo "&lt;p&gt;&lt;a href=\"#{$username}\"&gt;" . ucfirst($username) . "&lt;/a&gt; has been created! &lt;br&gt; Password: &lt;b&gt;{$hashToStoreInDb}&lt;/b&gt;&lt;/p&gt;";
                } else {
                    // query failed
                    mysqli_free_result($register_result);
                    mysqli_close($connect);
                }
            } else {
                echo "&lt;p&gt;Password does not match!&lt;/p&gt;";
            }
        }
    } else {
        // query failed
        mysqli_free_result($userexist_result);
        mysqli_close($connect);
    }


}
As others have mentioned, use the PDO library for database work and there is no reason to use gobals. Another thing I would highly recommend, is to use exceptions, they're amazing. I'm glad to see you using the password_* library though.

I have wrote a simple authentication class to get you started, and should by no means be used in a production environment.

class Auth
{
    private $dbh;
    private $config;
    private $user;

    public function __construct(PDO $dbh, array $config = array())
    {
        $this-&gt;dbh = $dbh;
        $this-&gt;config = $config;
        session_start();

        if ($this-&gt;isLoggedIn()) {
            $this-&gt;user = $this-&gt;getLoggedInUser();
        }
    }

    public function login($username, $password)
    {
        // check if user is already logged in

        // now validate your input data

        $user = $this-&gt;findUserByUsername($username);
        var_dump($user);

        if ($user) {
            if (password_verify($password, $user-&gt;password)) {
                $_SESSION['username'] = $user-&gt;username;
                $this-&gt;user = $user;

                return true;
            }

            throw new Exception('The password is incorrect');
        }

        throw new Exception("The username {$username} could not be found");
    }

    public function register(array $data)
    {
        // data validation goes here

        if ($data['password'] !== $data['password_again']) {
            throw new Exception("The passwords do not match");
        }

        if ($this-&gt;findUserByUsername($data['username'])) {
            throw new Exception('The username ' . $data['username'] . ' already exists');
        }

        $hash = password_hash($data['password'], PASSWORD_BCRYPT, array('cost' =&gt; 11));
        $sql = 'INSERT INTO users(username, password) VALUES (:username, :password)';

        $stmt = $this-&gt;dbh-&gt;prepare($sql);
        $stmt-&gt;bindParam(':username', $data['username'], PDO::PARAM_STR);
        $stmt-&gt;bindParam(':password', $hash, PDO::PARAM_STR);
        $result = $stmt-&gt;execute();

        if ($result) {
            $this-&gt;login($data['username'], $data['password']);

            return true;
        }

        throw new Exception('Something went seriously wrong');
    }

    public function logout()
    {
        if ($this-&gt;isLoggedIn()) {
            unset($_SESSION['username']);

            return true;
        }

        return false;
    }

    public function isLoggedIn()
    {
        return array_key_exists('username', $_SESSION);
    }

    public function getLoggedInUser()
    {
        if ($this-&gt;user === null) {
            $this-&gt;user = $this-&gt;findUserByUsername($_SESSION['username']);
        }

        return $this-&gt;user;
    }

    protected function findUserByUsername($username)
    {
        $stmt = $this-&gt;dbh-&gt;prepare('SELECT * FROM users WHERE username = :username');
        $stmt-&gt;bindParam(':username', $username, PDO::PARAM_STR);
        $stmt-&gt;execute();

        return $stmt-&gt;fetch(PDO::FETCH_OBJ);
    }
}

$dbh = new PDO('mysql:host=localhost;dbname=test', 'root', '');
$auth = new Auth($dbh);

try {

    // login example
    //$auth-&gt;login($_POST['username'], $_POST['password']);

    // register example
    //$auth-&gt;register($_POST);

} catch (Exception $e) {

    die($e-&gt;getMessage());
}

// logout
if (isset($_GET['logout'])) {
    $auth-&gt;logout();
}

// check if logged in
if ($auth-&gt;isLoggedIn()) {
    $username = $auth-&gt;getLoggedInUser()-&gt;username;

    echo '&lt;p&gt;Welcome &lt;a href=#' . $username . '&gt;' . ucfirst($username) . '&lt;/a&gt;&lt;/p&gt;';
    echo '&lt;p&gt;&lt;a href="?logout"&gt;Logout&lt;/a&gt;&lt;/p&gt;';
}