I'm fairly new to MySQLi and PHP, but I've been working at it for a bit now, and reading up on how to make secure login forms, avoid SQL injection etc. I'm a mere amateur though.I've created an index.html page (not including the code here, just a basic form though), a register.html page (not including the code here, again it's just a basic form), adduser.php (which gets its call from action on the registration form),login.php (obviously gets its action from the index.html login form), logout.php, and a restricted.php with a check if session is active.Everything is working. I'm just looking for some expert eyes to take a gander at my code and let me know if I'm missing anything whether it be major or minor, any security flaws, etc. Currently I don't have any form validation as I'm thinking of doing it client side with jQuery.adduser.php<?phperror_reporting(E_ALL);session_start();$mysqli = new mysqli ('localhost', '***', '***', 'test');if($mysqli->connect_errno > 0) {    die('Unable to connect to database [' . $mysqli->connect_error . ']');}if(isset($_POST['submit'])) {    $errors = array();    $data = array();    $fname = $_POST['fname'];    $lname = $_POST['lname'];    $username = $_POST['username'];    $email = $_POST['email'];    $password = $_POST['password'];    $confpass = $_POST['confpass'];    $password_hash = password_hash($password, PASSWORD_DEFAULT);        if(!($stmt = $mysqli->prepare(INSERT INTO users (fname, lname, username, email, password)         VALUES (?,?,?,?,?)))){        echo Prepare failed: ( . $mysqli->errno . ) . $mysqli->error;    }    if(!$stmt->bind_param('sssss', $fname, $lname, $username, $email, $password_hash)){     echo Binding paramaters failed:( . $stmt->errno . ) . $stmt->error;    }    if(!$stmt->execute()){     echo Execute failed: ( . $stmt->errno .) . $stmt->error;    }    if($stmt) {        header('Location: index.html#testform')    }    else{        echo Registration failed;    }}$mysqli->close();login.php<?phperror_reporting(E_ALL);$mysqli = new mysqli ('localhost', '***', '***', 'test');if($mysqli->connect_errno > 0) {    die('Unable to connect to database [' . $mysqli->connect_error . ']');}ob_start();session_start();    $username = $_POST['username'];    $password = $_POST['password'];if(isset($_POST['submit'])) {    if(!($stmt = $mysqli->prepare(SELECT username, password FROM users WHERE username = ?))){            echo Prepare failed: ( . $mysqli->errno . ) . $mysqli->error;    }    if(!$stmt->bind_param('s', $username)){        echo Bind failed: ( . $stmt->errno . ) . $stmt->error;    }    if(!$stmt->execute()){     echo Execute failed: ( . $stmt->errno .) . $stmt->error;    }    $userdata = $stmt->get_result();    $row = $userdata->fetch_array(MYSQLI_ASSOC);    $stmt->bind_result($username, $password);    $stmt->store_result();             if(password_verify($password, $row['password'])){            $_SESSION['user'] = $_POST['username'];            header('Location: restricted.php');            exit();        }    else{        echo Login Failed: ( . $stmt->errno .) . $stmt->error;    }$stmt->close();}$mysqli->close();restricted.php (just the top session code, the rest of the page is useless for the sake of this post)<?phperror_reporting(E_ALL);ob_start();session_start();$db = new mysqli ('localhost', '***', '***', 'test');if($db->connect_errno > 0) {    die('Unable to connect to database [' . $db->connect_error . ']');}if (!isset($_SESSION['user'])) {    header('Location: index.html');}?>logout.php<?phpsession_start();if(session_destroy()) // Destroying All Sessions{header(Location: index.html); // Redirecting To Home Page}?>
PHP registration/login form
php;security;mysqli;sql injection