安全登录php脚本

我做了一个登录系统,其中插入的_id和插入的_密码被发送到 login.inc.php XMLHttpRequest . 我不确定我的php脚本是否安全。我需要一些关于我的剧本的安全建议。

login.inc.php:

<?php
    session_start();
    $conn = mysqli_connect("localhost", "root", "", "users");
    $params = json_decode(file_get_contents('php://input'), true);
    $inserted_id = $params['inserted_id'];
    $inserted_password = $params['inserted_password'];

    $stmt = mysqli_stmt_init($conn);
    if (mysqli_stmt_prepare($stmt, "SELECT * FROM user WHERE account_name=? OR email=?;")) {
        mysqli_stmt_bind_param($stmt, "ss", $inserted_id, $inserted_id);
        mysqli_stmt_execute($stmt);
        $row = mysqli_fetch_assoc(mysqli_stmt_get_result($stmt));
        if ($row == null) {
            echo ("DOESNT EXISTS");
        } else {
            if (password_verify($inserted_password, $row['password'])) {
                $_SESSION['user_id'] = $row['id'];
                echo("SUCCESS");
            } else {
                echo("PASSWORD_FAIL");
            }
        }
    }
?>

signup.inc.php:

<?php
    $conn = mysqli_connect("localhost", "root", "", "users");
    $params = json_decode(file_get_contents('php://input'), true);
    $inserted_first_name = $params['first_name'];
    $inserted_last_name = $params['last_name'];
    $inserted_dob = $params['dob'];
    $inserted_email = $params['email'];
    $inserted_account_name = $params['account_name'];
    $inserted_password = $params['password'];

    $stmt = mysqli_stmt_init($conn);
    if (mysqli_stmt_prepare($stmt, "SELECT * FROM user WHERE email=?;")) {
        mysqli_stmt_bind_param($stmt, "s", $inserted_email);
        mysqli_stmt_execute($stmt);
        if (mysqli_num_rows(mysqli_stmt_get_result($stmt)) > 0) {
            echo("EMAIL_TAKEN");
        } else {
            $hashed_password = password_hash($inserted_password, PASSWORD_DEFAULT);
            $created_id = rand(111111111, 999999999);
            $stmt = mysqli_stmt_init($conn);
            if (mysqli_stmt_prepare($stmt, "INSERT INTO user(id, first_name, last_name, dob, email, account_name, password) VALUES (?, ?, ?, ?, ?, ?, ?);")) {
                mysqli_stmt_bind_param($stmt, "issssss", $created_id, $inserted_first_name, $inserted_last_name, $inserted_dob, $inserted_email, $inserted_account_name, $hashed_password);
                $result = mysqli_stmt_execute($stmt);
                echo ($result ? "SUCCESS" : "FAIL");
            }
        }
        mysqli_stmt_close($stmt);
    }
?>