Authentication

You code is garbage:
- saveing pw in cookie
- no sql protection
- printing error message
- missing password_needs_rehash

Something has to be stored on the user's computer so the website can recognise whether the user is logged in or not. And whatever is stored on the computer has to MATCH what is on the server that is assigned to the user. It doesn't matter if it's a password or a random string that's not a password, because it has to match up to what's on the server assigned to the user anyway.

You might want me to validate ip addresses for in case cookies are stolen, but if someone has a dynamic ip address, they'll experience the bother of being repeatedly logged out. For extra security, when logging in, the user's ip address can be checked against other ip addresses's that have logged in for that user in the past.

I'll repeat again, the sql escaping functions that php provides programmers in their programming language, such as mysqli_real_escape_string, has been broken and can be exploited very easily by doing a quick search on Stack Overflow, so you should rely on a server firewall to protect against sql injections. It's like having a front door to your house made of paper if you rely on php's sql escaping functions.

The error message is printed because on all my websites there is an email form for the user to email the admin (me), so if for some rare and strange reason they cannot register to the website not only do they see a generic you could not sign up because of an error they see the exact error so they can email me the error if i used sentry all php errorts would go to my email automatically but it is good to print the error for that reason as well just to be safe

the password already is rehashed using bycrpt as it is using a default strength of three four or five one of the three the bcrypt algorithm has not been cracked and it takes an exponential time to brute force due to the fact that generating a password in bcrypt has a cost unlike mdfive or shaone and by the wayn rehasing passwords doesnt make it any less likely to be cracked

1. https://paragonie.com/blog/2015/04/secur...ersistence <- read it and learn from it.
2. Printing the mysql error is very bad and very dangerous.
3. https://stackoverflow.com/questions/5741...ape-string <- do you mean this?