I created small simple PHP Authentication API. I have a couple of scripts that I use for session, authentication and registration. Since I'm not an experienced backend and PHP developer, I wanted someone more experienced to review my scripts and tell me what I did wrong and what I can improve.
I did not use any framework; this is plain PHP.
User registration:
<?php require_once '../dbConnect.php'; $object = json_decode(file_get_contents("php://input"), true); if (isset($object['email']) && isset($object['password']) && isset($object['firstName']) && isset($object['lastName'])) { $email = $object['email']; $validationQuery="select * from members where email='$email'"; $result = $mysqli->query($validationQuery) or die($mysqli->error.__LINE__); $member = mysqli_fetch_assoc($result); if($member) { $message = array('message' => 'Member with provided email address already exist, please use other email.'); http_response_code(406); echo json_encode($message); } else { session_start(); $firstName = $object['firstName']; $lastName = $object['lastName']; $password = password_hash($object['password'], PASSWORD_DEFAULT); $registrationQuery = "INSERT INTO members (firstName, lastName, email, password) VALUES ('$firstName', '$lastName', '$email', '$password')"; if ($mysqli->query($registrationQuery) === TRUE) { $message = array( 'message' => 'Registration Successful, you can use your credentials to log in.', 'memberId' => mysqli_insert_id($mysqli)); $_SESSION["id"] = $message['memberId']; echo json_encode($message); } } $mysqli->close(); } else { http_response_code(400); } ?> Getting authenticated member from session:
<?php require_once '../dbConnect.php'; session_start(); $object = json_decode(file_get_contents("php://input"), true); if (isset($object['email']) && isset($object['password'])) { $email = $object['email']; $password = $object['password']; $query="select * from members where email='$email'"; $result = $mysqli->query($query) or die($mysqli->error.__LINE__); $member = mysqli_fetch_assoc($result); if($member) { if (password_verify($object['password'], $member['password'])) { $message = array('message' => 'Authentication Successful!'); $_SESSION["id"] = $member['id']; echo json_encode($message); } else { $message = array('message' => 'Wrong Credentials, Authentication failed!'); session_destroy(); http_response_code(400); echo json_encode($message); } } else { session_destroy(); http_response_code(406); } $mysqli->close(); } else { session_destroy(); http_response_code(400); } ?> Getting authenticated member from PHP session cookie
<?php require_once '../dbConnect.php'; session_start(); if (isset($_SESSION["id"])) { $memberId = $_SESSION["id"]; $query="select id, firstName, lastName, email, profileImage from members where id='$memberId'"; $result = $mysqli->query($query) or die($mysqli->error.__LINE__); $member = mysqli_fetch_assoc($result); echo $json_response = json_encode($member); $mysqli->close(); } else { http_response_code(401); } ?> Simple logout script:
<?php session_start(); if (isset($_SESSION["id"])) { $message = array('message' => 'Successful log out!'); session_destroy(); echo json_encode($message); } else { echo 'You are not logged in!'; http_response_code(403); } ?> 
