I've prepared a simple login form, using prepared statements to prevent SQL injections. How secure is this ?     <head>    <title>Login</title>        <?php        session_start();        // set up a token        $form_token = md5(uniqid('auth', true));        // session form token        $_SESSION['form_token'] = $form_token;        if (isset($_SESSION['user_id'])) {            print You're already logged in;        }    ?></head><body>    <h3>Login!</h3>    <?php    if (isset($_SESSION['user_id'])) {        print <a href='logout.php'>Log Out Here</a>;        exit;    }    ?>    <form action=login.php method=post>        <p>Username :</p>        <input type=text name=username maxlength=20>        <p>Password :</p>        <input type=text name=pswd maxlength=20>        <input type=hidden name=form_token value=<?php echo $form_token; ?> />        <input type=submit value=Login>    </form>    </body>Nothing too special on the form.. Now, the PHP that process the data:     <head>    <title>Login</title>    <?php    session_start();    $message = ;    if (isset($_SESSION['user_id'])) {        $message .= You're already logged in<br/>;        print $message;        print <a href='logout.php'>Log Out Here</a>;        exit;    }    //     // GET THE USER DATA    //     $username = $_POST['username'];    $pswd = $_POST['pswd'];    $form_token = $_POST['form_token'];    //     // CHECK THE DAATA    //     if (empty($username) || empty($pswd) || !isset($form_token)) {        $message .= Please enter a valid username/password <br/>;    }    elseif ($form_token != $_SESSION['form_token']) {        $message .= Invalid Form Submission <br/>;    }    elseif (strlen($username) > 20 || strlen($username) < 4) {        $message .= Invalid length for a username <br/>;    }    elseif (strlen($pswd) > 20 || strlen($username) < 4) {        $message .= Invalid length for a username <br/>;    }    else {        // encrypting the password    $pswd = sha1($pswd);        // *********************        // CONNECTING TO THE DATABASE        // *********************    $servername = localhost;    $usrname = root;    $password = ;    $db_name = auth;    // connect to the database    $conn = new mysqli($servername, $usrname, $password, $db_name);    if ($conn->connect_error) {        die(Connection failed.$conn->connect_error);    }    // statement    $stmnt = $conn->prepare(SELECT username, pswd FROM users WHERE username = ? AND pswd = ?);    $stmnt->bind_param('ss', $username, $pswd);    $stmnt->execute();    $result = $stmnt->get_result();    if ($result->num_rows > 0) {            $user_id = $result;            $_SESSION['user_id'] = $result;            $message .= Succesfully Logged in!;    }    else {        $message .= Failed to Log In. Invalid Username or Password;    }    }    ?></head><body><?php    print $message;?></body>
Security of login form using prepared statements
php;security;authentication;mysqli