I’m here to break down the security upgrades I made in Version 2 of my PHP login script compared to Version 1. I really cranked up the security to make sure my user data is locked down tight and safe from all kinds of attacks. **Password Storage** In Version 1, I was using md5() for hashing passwords. That’s pretty much like using a paper shield against a machine gun—totally not secure because it’s vulnerable to collisions and brute-force attacks. In Version 2, I swapped out md5() for password_hash() with PASSWORD_BCRYPT. This is the real deal for password hashing. It’s got salting and adaptive cost parameters, making it way tougher to crack. It’s like moving from a flimsy lock to a high-tech security system. **Input Sanitization and Validation** With Version 1, I was just sanitizing inputs with mysqli_real_escape_string(). It helped a bit, but it didn’t cover all the bases. In Version 2, I stepped it up by using filter_var() with FILTER_SANITIZE_STRING. This move not only escapes special characters but also deals with unwanted HTML stuff. It’s like adding an extra layer of armor to make sure user data is handled safely. **SQL Injection Prevention** In Version 1, I was relying on mysqli_real_escape_string() to escape user inputs. While it did its job, it wasn’t foolproof against all SQL injection tricks. In Version 2, I switched to using prepared statements with mysqli_stmt_bind_param() and mysqli_stmt_execute(). This approach totally separates the SQL code from the data inputs, making it almost impossible for attackers to mess with my queries. It’s like going from a flimsy lock to a state-of-the-art security system. **Conclusion** The upgrades I made in Version 2 really beef up the security compared to Version 1. By adopting password_hash() for passwords, stepping up input validation with filter_var(), and using prepared statements for SQL queries, I’m now in a much stronger position to fend off common web threats. These changes show I’m all in on keeping data secure and up-to-date with current best practices. **Security Scoring** **Version 1: 60/100**: I was doing some basic input sanitization and SQL injection defense with escaping, but my password hashing was totally outdated, and I didn’t have comprehensive input validation. **Version 2: 90/100**: I stepped up my game with strong password hashing using password_hash() and PASSWORD_BCRYPT. I also got serious about input sanitization and validation, and I switched to prepared statements for SQL injection prevention. **Summary**: I enhanced version two by addressing several key security issues head-on. First, I modified our SQL queries to avoid using `SELECT *`, ensuring that only the necessary columns are retrieved. This change not only improved system performance but also minimized the exposure of data in the event of an SQL injection attack. Recognizing the risk of outdated password hashes, I updated our password hashing method to regularly refresh with more secure algorithms. This ensured that even if hashed data was compromised, cracking the passwords would be significantly more difficult for attackers. I also revamped the way we handle database connections. Instead of keeping connections open continuously, I set them to open only when needed and close immediately after use. This approach conserved resources and limited the opportunity for attackers to exploit open connections. To prevent brute force attacks, I introduced limits on login attempts, locking accounts after several failed tries. This measure added a robust layer of protection, making it much harder for attackers to guess passwords through repeated attempts. Each of these enhancements collectively fortified our script against common vulnerabilities, making version two much more secure. **Notes**: Kindly, check version 2 on my github account: [Login Registration System](https://github.com/majdi-php-sql/login_registration_system) We scored the current version a 90 out of 100. The big question now is: Why didn’t we hit 100? What else do we need to consider? And is it even possible to get a perfect score? I’ll tackle all these major questions in part 6. Good Luck