1. $_POST data can't be trusted, not just inside of SQL queries but also inside of $_SESSION.
2. You are not using remotely acceptable password practices. Learn about password hashing using and password_hash() and password_verify().
We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.