few days ago i made small PHP Authentication API with all basic functionalities (log in, log out, registration, getting authenticated member) and i got suggestions that i should use prepared statements for better performance and SQL Injection defense, so i made some changes to my script and it looks like this, can anyone confirm if it is good, did i miss something and is there anything else that i can improve here.<?phprequire_once '../dbConnect.php';session_start();$object = json_decode(file_get_contents(php://input), true);if (isset($object['email']) && isset($object['password'])) {    $email = $object['email'];    $password = $object['password'];    $stmt = $mysqli->prepare(select id, password from members where email = ?);    $stmt->bind_param(s, $email);    $stmt->execute();    $stmt->bind_result($id, $password);    $stmt->fetch();    if($id) {        if (password_verify($object['password'], $password)) {            $message = array('message' => 'Authentication Successful!');            $_SESSION[id] = $id;            echo json_encode($message);        } else {            $message = array('message' => 'Wrong Credentials, Authentication failed!');            session_destroy();            http_response_code(400);            echo json_encode($message);        }    } else {        session_destroy();        http_response_code(406);    }    $mysqli->close();} else {    session_destroy();    http_response_code(400);}?>
User Authentication PHP script
php;api;authentication