One of my github issues is below. I am having some problems with my security, is there anything that I should or need to improve. Here is an example of code that I use, but throughout the script there are some problems. <?phpsession_start();error_reporting(0);include '../config.php';$pass = substr(sha1($_POST['passwordp'], PASSWORD_BCRYPT), -10);$conn = new mysqli($hostname, $username, $password, $db_name);$query = mysqli_query($conn, SELECT * FROM `Administrators` WHERE username = '.addslashes($_POST['usernamep']).' AND password='.$pass.');$query = mysqli_query($conn, SELECT * FROM `Administrators` WHERE username = '.addslashes($_POST['usernamep']).' AND password='.$pass.'); if (mysqli_num_rows($query) > 0) { $_SESSION['username'] = $_POST['usernamep']; header('Location: dashboard.php'); } else { header('Location: index.php?alert'); $query = mysqli_query($conn, SELECT * FROM `Administrators` WHERE username = '.addslashes($_POST['usernamep']).' AND password='.$pass.');$query = mysqli_query($conn, SELECT * FROM `Administrators` WHERE username = '.addslashes($_POST['usernamep']).' AND password='.$pass.');if (mysqli_num_rows($query) > 0) {    $_SESSION['username'] = $_POST['usernamep'];    header('Location: dashboard.php');} else {    header('Location: index.php?alert');}  } ?>The link to the whole project is here (https://github.com/poKe-Websites/poKe-Multimedia-editor)
Improving PHP Security of Login
php;mysql;security;sql injection
As already noted in this answer, you should really use prepared statements. You should also not use simple sha1 hashing. Just because you added a PASSWORD_BCRYPT parameter to sha1 does not mean that you are using bcrypt. The second argument of sha1 is regarding raw output, not regarding the hashing itself. I provided a link to the correct function in my last answer, it's here: password_hash.Apart from that:Why do you have duplicate queries? You should remove 3 of them to simplify your code.I'm also not sure why you check the validity of the credentials twice. After the first check you already know if the user provided valid username and password, there is no need to check again.Your indentation is off, making it really hard to see where what if ends. You can use any IDE to properly format your code.