There are some things that I know that need to be fixed, such as mysql_* needing to be converted to PDO, and using a better hash. I am working on building a social networking site, and I've been having issues with some of the mysql like mysql_real_escape_string and implementing newer techniques. Any criticism and/or help would be very appreciated.register script<?$reg = @$_POST['reg'];//declaring variables to prevent errors//registration form$fn = (!empty($_POST['fname'])) ? $_POST['fname'] : '';$ln = (!empty($_POST['lname'])) ? $_POST['lname'] : '';$un = (!empty($_POST['username'])) ? $_POST['username'] : '';$em = (!empty($_POST['email'])) ? $_POST['email'] : '';$em2 = (!empty($_POST['email2'])) ? $_POST['email2'] : '';$pswd = (!empty($_POST['password'])) ? $_POST['password'] : '';$pswd2 = (!empty($_POST['password2'])) ? $_POST['password2'] : '';$d = date(y-m-d); // Year - Month - Dayif ($reg) {    if ($em==$em2) {        // Check if user already exists        $statement = $db->prepare('SELECT username FROM users WHERE username = :username');            if ($statement->execute(array(':username' => $un))) {                if ($statement->rowCount() > 0){                    //user exists                    echo Username already exists, please choose another user name.;                    exit();                }            }                    //check all of the fields have been filled in                        if ($fn&&$ln&&$un&&$em&&$em2&&$pswd&&$pswd2) {                            //check that passwords match                                if ($pswd==$pswd2) {                                    //check the maximum length of username/first name/last name does not exceed 25 characters                                        if (strlen($un)>25||strlen($fn)>25||strlen($ln)>25) {                                            echo The maximum limit for username/first name/last name is 25 characters!;                                        }                                        else                                            {                                                //check the length of the password is between 5 and 30 characters long                                                    if (strlen($pswd)>30||strlen($pswd)<5) {                                                        echo Your password must be between 5 and 30 characters long!;                                                    }                                                    else                                                        {                                                            //encrypt password and password 2 using md5 before sending to database                                                                $pswd = md5($pswd);                                                                $pswd2 = md5($pswd2);                                                                                                                                                                                               $db->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING );                                                                $sql = 'INSERT INTO users (username, first_name, last_name, email, password, sign_up_date)';                                                                $sql .= 'VALUES (:username, :first_name, :last_name, :email, :password, :sign_up_date)';                                                                $query=$db->prepare($sql);                                                                $query->bindParam(':username', $un, PDO::PARAM_STR);                                                                $query->bindParam(':first_name', $fn, PDO::PARAM_STR);                                                                $query->bindParam(':last_name', $ln, PDO::PARAM_STR);                                                                $query->bindParam(':email', $em, PDO::PARAM_STR);                                                                $query->bindParam(':password', $pswd, PDO::PARAM_STR);                                                                $query->bindParam(':sign_up_date', $d, PDO::PARAM_STR);                                                                $query->execute();                                                                die(<h2>Welcome to Rebel Connect</h2>Login to your account to get started.);                                                        }                                            }                                }                                else {                                    echo Your passwords do not match!;                                }                        }                else                    {                        echo Please fill in all fields!;                    }            }    else {        echo Your e-mails don't match!;    }}?>login script<?//Login Scriptif (isset($_POST[user_login]) && isset($_POST[password_login])) {    $user_login = preg_replace('#[^A-Za-z0-9]#i', '', $_POST[user_login]); // filter everything but numbers and letters    $password_login = preg_replace('#[^A-Za-z0-9]#i', '', $_POST[password_login]); // filter everything but numbers and letters    $password_login=md5($password_login);    $db = new PDO('mysql:host=localhost;dbname=socialnetwork', 'root', 'abc123');    $db->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING );    $sql = $db->prepare(SELECT id FROM users WHERE username = :user_login AND password = :password_login LIMIT 1);    if ($sql->execute(array(    ':user_login' => $user_login,    ':password_login' => $password_login))) {        if ($sql->rowCount() > 0){            while($row = $sql->fetch(PDO::FETCH_ASSOC)){                $id = $row[id];            }            $_SESSION[id] = $id;            $_SESSION[user_login] = $user_login;            $_SESSION[password_login] = $password_login;            exit(<meta http-equiv=\refresh\ content=\0\>);        } else {            echo 'Either the password or username you have entered is incorrect. Please check them and try again!';            exit();        }    }}?>profile.php<? include(inc/incfiles/header.inc.php);?><?if(isset($_GET['u'])){    $username = mysql_real_escape_string($_GET['u']);    if(ctype_alnum($username)) {            //check user exists    $check = mysql_query(SELECT username, first_name FROM users WHERE username='$username');    if(mysql_num_rows($check)===1){        $get = mysql_fetch_assoc($check);        $username = $get['username'];        $firstname = $get['first_name'];    }    else    {        echo <meta http-equiv=\refresh\ content=\0; url=http://localhost/tutorial/findfriends/index.php\>;        exit();    }    }}?><div class=postForm>Post form will go here</div><div class=profilePosts>Your posts will go here</div><img src= height=250 width=200 alt=<? echo $username; ?>'s Profile title=<? echo $username; ?>'s Profile /><br /><div class=textHeader><? echo $username; ?>'s Profile</div><div class=profileLeftSideContent> Some content about this person's profile </div><div class=textHeader><? echo $username; ?>'s Friends</div><div class=profileLeftSideContent><img src=# height=50 width=40/>&nbsp;&nbsp;<img src=# height=50 width=40/>&nbsp;&nbsp;<img src=# height=50 width=40/>&nbsp;&nbsp;<img src=# height=50 width=40/>&nbsp;&nbsp;<img src=# height=50 width=40/>&nbsp;&nbsp;<img src=# height=50 width=40/>&nbsp;&nbsp;<img src=# height=50 width=40/>&nbsp;&nbsp;<img src=# height=50 width=40/>&nbsp;&nbsp;</div>
Review my PHP login and register script, and profile page, and how to improve them
php;pdo