title: Login Form safety precautions
body: <p>I'm using this code in my login form.Everything is working:</p>
  
  <pre><code>$username = trim($_POST['username']);
  $password = trim($_POST['password']);
  $pass=md5($password);
  $stmt = $mysqli-&gt;prepare("SELECT id FROM users WHERE username = ? AND password = ?");
  $stmt-&gt;bind_param('ss', $username, $pass);  
  $stmt-&gt;execute();    
  $stmt-&gt;store_result();
  $stmt-&gt;bind_result($id);
  $stmt-&gt;fetch();
  
  if ($stmt-&gt;num_rows == 1) { $_SESSION['name']=$id; echo'user logged in';}
  else {echo'invalid username / password';}
  $stmt-&gt;close();
  </code></pre>
  
  <p>But should I use something else too? Or is it enough? I'm new to prepared statements so i would like to know if syntax is well written.</p>