PHP Login Script?
<p>I'm creating a small membership site. I've created a login script and was wondering if this is  on it's way to becoming secure from common attacks and what else I could do to make it even more secure. No credit card details are stored on the system, that's being processed by a separate merchant.</p>

<p>Login.php</p>

<pre><code>&lt;?php
session_start();

$notifications = array();

if(!empty($_POST['login'])) {

    if(empty($_POST['email']) || empty($_POST['password'])) {
        $notifications[] = 'Login failed! Please provide a username and password.';
    }

    if(count($notifications) == 0) {
        try {
            $dbh = new PDO('mysql:dbname=lf_database;host=127.0.0.1', 'root', 'root');

            $sql = "SELECT email, verified FROM users WHERE email = :email AND password = :password";
            $sth = $dbh-&gt;prepare($sql);
            $sth-&gt;execute(array(
                ':email'    =&gt; $_POST['email'],
                ':password' =&gt; md5($_POST['password'])
            ));

            $result = $sth-&gt;fetch(PDO::FETCH_ASSOC);

            if($result) {
                // Set session details and redirect user to members page
                session_regenerate_id();
                $_SESSION['logged_in'] = true;
                $_SESSION['verified'] = $result['verified'];
                $_SESSION['created'] = time();
                $_SESSION['ua'] = md5($_SERVER['HTTP_USER_AGENT']) . 'fable3';

                header('Location: members.php');
            } else {
                $notifications[] = "Username or Password incorrect.";
            }
        } catch (PDOException $e) {
            echo 'We\'re having database issues at the moment. Don\'t worry, we\'re getting it sorted!';
        }
    }

} elseif(!empty($_POST['forgot_password'])) {
    // Not yet implemented
}

?&gt;


&lt;!DOCTYPE html&gt;
&lt;html lang="en"&gt;
&lt;head&gt;
&lt;meta charset="utf-8"&gt;
&lt;title&gt;Members Login&lt;/title&gt;
&lt;link rel="stylesheet" type="text/css" href="css/reset.css"&gt;
&lt;!--[if IE]&gt;
    &lt;script src="http://html5shiv.googlecode.com/svn/trunk/html5.js"&gt;&lt;/script&gt;
&lt;![endif]--&gt;
&lt;/head&gt;

&lt;body id="home"&gt;

&lt;h1&gt;Members Login&lt;/h1&gt;

&lt;?php if(count($notifications) &gt; 0) : ?&gt;
    &lt;ul&gt;
        &lt;?php foreach($notifications as $notification) : ?&gt;
            &lt;li&gt;&lt;?php print $notification ?&gt;&lt;/li&gt;
        &lt;?php endforeach; ?&gt;
    &lt;/ul&gt;
&lt;?php endif; ?&gt;

&lt;form method="POST" action=""&gt;
    &lt;fieldset&gt;
        &lt;legend&gt;Login&lt;/legend&gt;
        &lt;input type="email" name="email" placeholder="Email Address" required&gt;
        &lt;input type="password" name="password" placeholder="Password" required&gt;
        &lt;input type="submit" name="login" value="Login"&gt;
    &lt;/fieldset&gt;
&lt;/form&gt;
&lt;a href="#"&gt;Need Account? Sign Up&lt;/a&gt;

&lt;form method="POST" action=""&gt;
    &lt;fieldset&gt;
        &lt;legend&gt;Forgot Your Password?&lt;/legend&gt;
        &lt;input type="email" name="forgot_password_email" placeholder="Email Address" required&gt;
        &lt;input type="submit" name="forgot_password" value="Request New Password"&gt;
    &lt;/fieldset&gt;
&lt;/form&gt;

&lt;/body&gt;
&lt;/html&gt;
</code></pre>

<p>Members.php</p>

<pre><code>&lt;?php
session_start();

$verified = false;

// Is the user logged in?
if(!isset($_SESSION['logged_in'])) {
    session_destroy();
    header('Location: login.php');
}

// Is the previous session valid?
if ($_SESSION['ua'] != md5($_SERVER['HTTP_USER_AGENT']) . 'fable3') {
    session_destroy();
    header('Location: login.php');
}

// Is the user verified?
if(isset($_SESSION['verified'])) {
    if($_SESSION['verified']) {
        $verified = true;
    }
}

    // Expire session here after 2 hours (user will be watching a movie, no point expiring before hand)
?&gt;
&lt;h1&gt;Logged In!&lt;/h1&gt;

&lt;h2&gt;Debug:&lt;/h2&gt;
&lt;pre&gt;&lt;?php print_r($_SESSION); ?&gt;&lt;/pre&gt;

&lt;a href="logout.php"&gt;Logout&lt;/a&gt;
</code></pre>
