title: Prevent malicious attacks on php login system
body: <p>I'm developing a C# application that allows the user to register and login. I'm planning to use MySQL database and PHP on server side code.
  Here is the server-side code that I plan to use. This code copied from the below two articles.</p>
  
  <p><a href="http://csharp-tricks-en.blogspot.com/2015/03/secure-php-login-system-protected.html" rel="nofollow noreferrer">(Secure) PHP Login System (Protected Against SQL-Injections)</a><br>
  <a href="http://csharp-tricks-en.blogspot.com/2015/03/login-system-with-php.html" rel="nofollow noreferrer">Login System with PHP</a></p>
  
  <p><strong>register.php</strong> </p>
  
  <pre><code>&lt;?php
  $conn = new mysqli("db4free.net", "csharptricks", "12345678", "csharptricks");
  
  $username = $_POST["username"];
  $password = $_POST["password"];
  $hashedpw = md5($password);
  
  $stmt = $conn-&gt;prepare("SELECT username FROM Users WHERE username = ?");
  $stmt-&gt;bind_param("s", $username);
  $stmt-&gt;execute();
  $stmt-&gt;store_result();
  
  if ($stmt-&gt;num_rows &gt; 0) {
       echo "Existing";
  }
  else { 
       $stmt = $conn-&gt;prepare("INSERT INTO Users (username, password) VALUES (?, ?);");
       $stmt-&gt;bind_param("ss", $username, $hashedpw);
       $stmt-&gt;execute();
       echo "Success";
  }
  ?&gt;
  </code></pre>
  
  <p><strong>login.php</strong> </p>
  
  <pre><code>&lt;?php
  session_start();
  
  $conn = new mysqli("db4free.net", "csharptricks", "12345678", "csharptricks");
  
  $username = $_POST["username"];
  $password = $_POST["password"];
  $hashedpw = md5($password);
  
  $stmt = $conn-&gt;prepare("SELECT username, password FROM Users WHERE username = ? LIMIT 1");
  $stmt-&gt;bind_param("s", $username);
  $stmt-&gt;execute();
  $stmt-&gt;bind_result($output1, $output2);
  $row = $stmt-&gt;fetch();
  
  if($output2 == $hashedpw) { 
      $_SESSION["username"] = $username; 
      echo "LoginGood"; 
  } 
  else { 
      echo "LoginBad"; 
  } 
  ?&gt;
  </code></pre>
  
  <p>I'm new to PHP, so I would like to know from experts is there any risk at this code. Any advice and suggestions are highly appreciated.</p>
  
  <p>Thanks in advance.</p>