I need some help with my register and log in functions. I'm not sure if I have understood bcrypt correctly either. I'm doubting the security of it, what do you think?Is this good, or are there any changes I should make? Have I missed anything?For the database table users, I created (ID, username and password[char:60]):function loginAccount() {    global $connect;    $username = mysqli_real_escape_string($connect, $_POST['username']);    $password = mysqli_real_escape_string($connect, $_POST['password']);    $existingHashFromDb = ;    if(!isset($existingHashFromDb)) {        // existing password from database is not set    } else {        $login_sql = SELECT password FROM users WHERE username = '.$username.';        $login_result = mysqli_query($connect, $login_sql);        if($login_result) {            while($row = mysqli_fetch_assoc($login_result)) {                $existingHashFromDb = $row['password'];            }            # Check if the hash of the entered login password, matches the stored hash.            # The salt and the cost factor will be extracted from $existingHashFromDb.            $isPasswordCorrect = password_verify($password, $existingHashFromDb);            if($isPasswordCorrect) {                // you are logged in                echo <p>Welcome <a href=\#{$username}\> . ucfirst($username) . </a></p>;                // logout?                echo <p><a href=\?logout\>Logout</a></p>;            } else {                echo <p>Password did not match.</p>;            }        } else {            // query failed            mysqli_free_result($login_result);            mysqli_close($connect);        }    }}function registerAccount() {    global $connect;    $username       = mysqli_real_escape_string($connect, $_POST['username']);    $password       = mysqli_real_escape_string($connect, $_POST['password']);    $password_again = mysqli_real_escape_string($connect, $_POST['password_again']);    # This way you can define a cost factor (by default 10). Increasing the    # cost factor by 1, doubles the needed time to calculate the hash value.    $hashToStoreInDb = password_hash($password, PASSWORD_BCRYPT, array(cost => 11));    # See if the username already exists in the database    $userexist_query = SELECT username FROM users WHERE username = '.$username.';    $userexist_result = mysqli_query($connect, $userexist_query);    if($userexist_result) {        if(mysqli_num_rows($userexist_result) >= 1) {            echo <p>Username already exists!</p>;        } else {            # See if the password and password_again is matching.            if($password == $password_again) {                $register_query  = INSERT INTO users (username, password) VALUES ('$username', '$hashToStoreInDb');                $register_result = mysqli_query($connect, $register_query);                if($register_result) {                    echo <p><a href=\#{$username}\> . ucfirst($username) . </a> has been created! <br> Password: <b>{$hashToStoreInDb}</b></p>;                } else {                    // query failed                    mysqli_free_result($register_result);                    mysqli_close($connect);                }            } else {                echo <p>Password does not match!</p>;            }        }    } else {        // query failed        mysqli_free_result($userexist_result);        mysqli_close($connect);    }}
Security of login and register system
php;security;authentication;mysqli