View difference between Paste ID: qMS3UEFE and KufJXQeG

   //Inserisco i dati nel DB
   $nome = $_GET['nome'];
   $cognome = $_GET['cognome'];
   $email = $_GET['email'];
   $username = $_GET['username'];
   $password = $_GET['password'];
   $hash = password_hash($password, PASSWORD_BCRYPT);
   $sql = "INSERT INTO clienti (nome, cognome, email, username, password)
   VALUES (:nome, :cognome, :email, :username, :password)";
   $req = $dbh->prepare($sql);
   $req->execute(
     array(
       ":nome" => $nome,
       ":cognome" => $cognome,
       ":email" => $email,
       ":username" => $username,
       ":password" => $hash,
     )
   );
 
 
 
  //login
 
 require_once 'includes/connect-db.php';
 
 session_start();
 $_SESSION['loggato'] = false;
 
-$username = $_REQUEST['username'];
+// non utilizzare mai $_REQUEST
-$password = $_REQUEST['password'];
+$username = $_POST['username'];
 $password = $_POST['password'];
-$sql = "SELECT * FROM clienti WHERE username = :username AND password = :password";
+
 $sql = "SELECT password FROM clienti WHERE username = :username";
 $req = $dbh->prepare($sql);
 
 $req->execute(
-    ":username" => $_REQUEST['username'],
+
-    ":password" => $_REQUEST['password']
+    ":username" => $username
   )
 );
 
 $utente = $req->fetch(PDO::FETCH_ASSOC);
 
-if($utente != null) {
+if(isset($utente['password']) && password_verify($password, $utente['password'])) {
   $_SESSION['loggato'] = true;
-  $_SESSION['utente'] = $utente;
+  $_SESSION['utente'] = $username; // inserisci solo la username e non la password in sessione
   Header('Location: index.php');
 } else {
   Header('Location: login.php?error=true');
 }