trjhtr

I would like to ask someone if the code i will put here is Secured for SQL injection and my password hashing and checking while user is logging in is secure and done well.

My Database connection :

$hostname='localhost';
$username='root';
$password='';

try 
 $dbh = new PDO("mysql:host=$hostname;dbname=myshop",$username,$password);
 $dbh->query ('SET NAMES utf8');
 $dbh->query ('SET CHARACTER_SET utf8_unicode_ci');
 $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // <== add this line
 catch (PDOException $e) 
 echo $e->getMessage();
 

My registration script :

include_once 'config.php';

$data = file_get_contents("php://input");
$data = json_decode($data, true);

try 
 $stmt = $dbh->prepare("INSERT INTO `accounts` (`account_id`, `firstname`, `lastname`, `username`, `password`, `email`, `city`, `postalcode`, `adress`, `country`, `role`)
 VALUES (NULL, :firstname, :lastname, :username, :password, :email, :city, :postalcode, :adress, :country, 0) ");
 $stmt->bindParam(':firstname', $data['firstname']);
 $stmt->bindParam(':lastname', $data['lastname']);
 $stmt->bindParam(':username', $data['username']);
 $stmt->bindParam(':password', password_hash($data['password'], PASSWORD_DEFAULT));
 $stmt->bindParam(':email', $data['email']);
 $stmt->bindParam(':city', $data['city']);
 $stmt->bindParam(':postalcode', $data['postalcode']);
 $stmt->bindParam(':adress', $data['adress']);
 $stmt->bindParam(':country', $data['country']);
 $stmt->execute();
 catch (PDOException $e) 
 if (strpos($e->getMessage(), "for key 'login'") !== false) 
 echo 'Duplicate login entry';
 exit;
 if (strpos($e->getMessage(), "for key 'email'") !== false) 
 echo 'Duplicate e-mail entry';
 exit;
 
 else 
 throw $e;
 
 
 echo 'Success';

My login script :

include_once 'config.php';

$data = file_get_contents("php://input");
$data = json_decode($data, true);

try 
 $stmt = $dbh->prepare("SELECT * from accounts WHERE
 username=:username");
 $stmt->bindParam(':username', $data['username']);
 $stmt->execute();
 catch (PDOException $e) 
 throw $e;
 

 $rows = $stmt->rowCount();
 $result = $stmt->fetchAll(PDO::FETCH_ASSOC);
 $json = json_encode($result);

 if ($rows === 1)
 if (password_verify($data['password'], $result[0]['password'])) 
 echo $json;
 exit;
 
 else
 echo 'Wrong password';
 exit;
 
 if ($rows === 0) 
 echo 'No account';
 exit;
 
 else 
 echo 'Something went wrong';
 exit;