Security of login form using prepared statements I've prepared a simple login form, using prepared statements to prevent SQL injections. How secure is this ? 

    &lt;head&gt;
    &lt;title&gt;Login&lt;/title&gt;
        &lt;?php
        session_start();

        // set up a token
        $form_token = md5(uniqid('auth', true));

        // session form token
        $_SESSION['form_token'] = $form_token;

        if (isset($_SESSION['user_id'])) {
            print "You're already logged in";
        }
    ?&gt;
&lt;/head&gt;
&lt;body&gt;
    &lt;h3&gt;Login!&lt;/h3&gt;
    &lt;?php
    if (isset($_SESSION['user_id'])) {
        print "&lt;a href='logout.php'&gt;Log Out Here&lt;/a&gt;";
        exit;
    }
    ?&gt;
    &lt;form action="login.php" method="post"&gt;
        &lt;p&gt;Username :&lt;/p&gt;
        &lt;input type="text" name="username" maxlength="20"&gt;

        &lt;p&gt;Password :&lt;/p&gt;
        &lt;input type="text" name="pswd" maxlength="20"&gt;
        &lt;input type="hidden" name="form_token" value="&lt;?php echo $form_token; ?&gt;" /&gt;

        &lt;input type="submit" value="Login"&gt;
    &lt;/form&gt;

    &lt;/body&gt;


Nothing too special on the form.. 
Now, the PHP that process the data: 

    &lt;head&gt;
    &lt;title&gt;Login&lt;/title&gt;

    &lt;?php
    session_start();
    $message = "";

    if (isset($_SESSION['user_id'])) {
        $message .= "You're already logged in&lt;br/&gt;";
        print $message;
        print "&lt;a href='logout.php'&gt;Log Out Here&lt;/a&gt;";
        exit;
    }

    // 
    // GET THE USER DATA
    // 
    $username = $_POST['username'];
    $pswd = $_POST['pswd'];
    $form_token = $_POST['form_token'];

    // 
    // CHECK THE DAATA
    // 

    if (empty($username) || empty($pswd) || !isset($form_token)) {
        $message .= "Please enter a valid username/password &lt;br/&gt;";
    }
    elseif ($form_token != $_SESSION['form_token']) {
        $message .= "Invalid Form Submission &lt;br/&gt;";
    }
    elseif (strlen($username) &gt; 20 || strlen($username) &lt; 4) {
        $message .= "Invalid length for a username &lt;br/&gt;";
    }
    elseif (strlen($pswd) &gt; 20 || strlen($username) &lt; 4) {
        $message .= "Invalid length for a username &lt;br/&gt;";
    }
    else {

        // encrypting the password

    $pswd = sha1($pswd);

        // *********************
        // CONNECTING TO THE DATABASE
        // *********************

    $servername = "localhost";
    $usrname = "root";
    $password = "";
    $db_name = "auth";

    // connect to the database
    $conn = new mysqli($servername, $usrname, $password, $db_name);
    if ($conn-&gt;connect_error) {
        die("Connection failed".$conn-&gt;connect_error);
    }

    // statement
    $stmnt = $conn-&gt;prepare("SELECT username, pswd FROM users WHERE username = ? AND pswd = ?");
    $stmnt-&gt;bind_param('ss', $username, $pswd);

    $stmnt-&gt;execute();

    $result = $stmnt-&gt;get_result();
    if ($result-&gt;num_rows &gt; 0) {
            $user_id = $result;
            $_SESSION['user_id'] = $result;
            $message .= "Succesfully Logged in!";
    }
    else {
        $message .= "Failed to Log In. Invalid Username or Password";
    }

    }

    ?&gt;

&lt;/head&gt;
&lt;body&gt;

&lt;?php
    print $message;

?&gt;

&lt;/body&gt;
I'll point out a few things here:


$pswd = sha1($pswd); is cringeworthy. Please use password_hash() if you can. If you can't update your PHP version to comply, my next best suggestion is to use crypt().
Having all of your DB connection code on the page is generally considered poor coding. Place everything between $servername ... // statement in a separate file and require it.
In your select statement, there is no reason to retrieve the password from the DB alongside the username. The less you deal with the password, most likely will be safer. Also, you're putting the hashed password in the session, which I'm not sure is the best idea. A phishing attempt could potentially reveal this and a malicious user could take advantage of this information.
Your method of creating a session token is weak, and I suggest you check out this StackOverflow post for more info.
Format your code. You're missing a lot of indentation and general style rules aren't 100% met.