Changes in html and Login/Register php

login.php

@@ -7,18 +7,23 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
     $username = $_POST['username'];
     $password = $_POST['password'];
 
-    $hashed_password = password_hash($password, PASSWORD_DEFAULT);
+    // Prepare and execute the SQL query using prepared statements
+    $query = "SELECT id, username, password, isAdmin FROM users WHERE username = ?";
+    $stmt = $mysqli->prepare($query);
+    $stmt->bind_param("s", $username);
+    $stmt->execute();
+    $stmt->bind_result($user_id, $user_username, $user_password, $user_isAdmin);
 
-    $query = "SELECT * FROM users WHERE username = '$username' AND password = '$hashed_password'";
-    $result = mysqli_query($mysqli, $query);
-
-    if (mysqli_num_rows($result) == 1) {
-        $user = mysqli_fetch_assoc($result);
-        $_SESSION['user_id'] = $user['id'];
-        header('Location: main.php');
+    // Fetch the result
+    if ($stmt->fetch() && password_verify($password, $user_password)) {
+        $_SESSION['user_id'] = $user_id;
+        header('Location: index.php');
         exit();
     } else {
         echo "Invalid username or password.";
     }
+
+    // Close the statement
+    $stmt->close();
 }
 ?>