sql - Are there any security vulnerabilities in this PHP registration code? -

Can you give some texts on this code? Do I miss some security holes? Can you see any danger? Can I do something better?

I'm still learning :) Thanks

   gt; {$ reg_error [] = 0; } // Make sure the user name is less than 3 letters, numbers or _ - if (! Preg_match ('/ ^ [a-zA-Z0-9 _-] {3,} $ /', $ username) Cosist only) {$ Reg_error [] = 4; } // Check the blank field if (empty ($ user name) || empty ($ password) || empty ($ password2)) {$ reg_error [] = 2; } // Check that if the password is found ($ password! = $ Password2) {$ reg_error [] = 3; } // save if the error is set (! Isset ($ reg_error)) {mysql_query ("username (username, password, registered, registration_ip) VALUES ('$ username', '$ encryptedpassword', '". Time (IN)). '', ''. $ _ SERVER ['SERVER_ADDR']. "')"); $ _SESSION ['id'] = mysql_insert_id (); Header ('Refresh: 3; url = / house'); }}? & Gt;  

Login. Php

  if (isset ($ _ POST ['username'])) {$ username = mysql_real_escape_string ($ _POST ['username']); $ Password = mysql_real_escape_string ($ _ POST ['password']); $ Md5_password = md5 ($ password); $ Query = mysql_query ("Select user WHERE user name id = '$ user name' and password = '$ MD5_password'"); If (mysql_num_rows ($ query) == 0) {header ("location:". $ _ Server ['REQUEST_URI']. ""); Go out; } // set session $ _SESSION ['id'] = mysql_result ($ query, 0, 'id'); Header ("Location: /"); Go out;  

You have not taken the password.

In addition, MD5 () is considered for the password for the hashing

Use instead.