Is such registration safe and correct?

Question

PHP

I am a beginner in php, I am studying locally and now I asked myself the following question: am I doing it right, I would like to know what errors and how safe such registration is

$my = mysqli_connect("localhost", "root", "") or die("Ошибка");
mysqli_select_db($my, "user");

if (isset($_POST)) {
    $name = htmlspecialchars(mysqli_real_escape_string($my,$_POST['name']));
    $login = htmlspecialchars(mysqli_real_escape_string($my,$_POST['login']));
    $password = htmlspecialchars(mysqli_real_escape_string($my,md5($_POST['password'])));
    $captcha = $_POST['captcha'];
    $query = mysqli_query($my,("SELECT * FROM `use` WHERE login='$login'")) or die("Ошибка");
    $user = mysqli_fetch_assoc($query);

if ($name == "" || $login == "" || $password == "") {
        echo "Заполните пустые поля";
}

else if (!preg_match("/^[a-zA-Z0-9\-\_\[\]\(\)]+$/i", $login)) {
        echo "Недопустимые символы";
}

else {
        if ($_SESSION['captcha'] == $captcha && $user['login'] !== $login) {
            $query = mysqli_query($my,"INSERT INTO `use` (`name`, `login`, `password`) VALUES ('$name', '$login', '$password')") or die("Ошибка");
            echo "Вы успешно зарегистрировались";
        }
        else if ($user['login'] == $login) {
            echo "Такой логин уже зарегистрирован";
        }
        else {
            echo "Каптча ведена неверно";
        }
    }
}

Answer 1

1. Remove all htmlspecialchars, mysqli_real_escape_string and the like from the code
2. Use PDO and placeholders ( the best guide)
3. Don't use md5, upgrade to php 5.5 and use the Password API (or at least sha if you can't upgrade)
4. Check the received data for invalid characters before any operations with them (you now have the first request before checking)
After these 4 points, the code will already be much better and safer.

Answer 2

php.net/manual/ru/pdo.prepare.php instead

$name = htmlspecialchars(mysqli_real_escape_string($my,$_POST['name']));
$login = htmlspecialchars(mysqli_real_escape_string($my,$_POST['login']));
$password = htmlspecialchars(mysqli_real_escape_string($my,md5($_POST['password'])));
$captcha = $_POST['captcha'];
$query = mysqli_query($my,("SELECT * FROM `use` WHERE login='$login'")) or die("Error");
$user = mysqli_fetch_assoc($query);

and hash the password

Answer 3

minimum against sql injections will stand. but security is a very broad matter and goes far beyond escaping special characters

Answer 4

I agree with Alexey Nikolaev.
And it’s better to study on the framework and work with MVC, if you have a desire to figure it out in a week, I can offer laravel 5

Answer 5

Thanks to all!

Answer 6

I advise you to use YII or CodeIgniter for such simple registrations (the latter is currently being updated)