Do I need to sanitize my login value in php -

following script used in login page

<?php //include config require_once('includes/config.php');  //check if logged in move home page if ($user->is_logged_in()) {     header('location: index.php'); }  //process login form if submitted if (isset($_post['submit'])) {      $username = filter_input(input_post, 'username');     $password = filter_input(input_post, 'password');      if ($user->login($username, $password)) {         $_session['username'] = $username;         header('location: memberpage.php');         exit;     } else {         $error[] = 'wrong username or password or account has not been activated.';     } }//end if submit //define page title $title = 'login';  //include header template require('layout/header.php'); ?> 

do need sanitize these inputs @ least mysql_real_escape_string or can use code?

user.php

<?php include('password.php'); class user extends password{      private $_db;      function __construct($db){         parent::__construct();          $this->_db = $db;     }      private function get_user_hash($username){            try {             $stmt = $this->_db->prepare('select password members username = :username , active="yes" ');             $stmt->execute(array('username' => $username));              $row = $stmt->fetch();             return $row['password'];          } catch(pdoexception $e) {             echo '<p class="bg-danger">'.$e->getmessage().'</p>';         }     }      public function login($username,$password){          $hashed = $this->get_user_hash($username);          if($this->password_verify($password,$hashed) == 1){              $_session['loggedin'] = true;             return true;         }        }      public function logout(){         session_destroy();     }      public function is_logged_in(){         if(isset($_session['loggedin']) && $_session['loggedin'] == true){             return true;         }            }  }   ?> 

password_verify() code

public function password_verify($password, $hash) {         if (!function_exists('crypt')) {             trigger_error("crypt must loaded password_verify function", e_user_warning);             return false;         }         $ret = crypt($password, $hash);         if (!is_string($ret) || strlen($ret) != strlen($hash) || strlen($ret) <= 13) {             return false;         }          $status = 0;         ($i = 0; $i < strlen($ret); $i++) {             $status |= (ord($ret[$i]) ^ ord($hash[$i]));         }          return $status === 0;     }  } 

since new php confused it. can me?

or user class protect login

does work?

i see:

if($this->password_verify($password,$hashed) == 1){ 

but there no password_verify() method in class. if mean password_verify() function, should change to:

if(password_verify($password,$hashed)){ 

to answer question, using prepared statements should not escape data, safe sql injection. if needed - if inject value directly query somewhere example - need pdo escaping function , not mysql_* one. using prepared statements consistently better solution cannot forget accident.

the real problem can see echo out catched exception message user. should log instead , present user non-technical error message.

and of course should add error handling database calls: empty result not error , not lead exception, lead problems in code, should check that.