Building a Login System in PHP

<?php
$password = 'correct horse battery staple';
$hash1 = password_hash($password, PASSWORD_DEFAULT);
$hash2 = password_hash($password, PASSWORD_DEFAULT);

echo substr($hash1, 0, 4) . "... (" . strlen($hash1) . " characters)\n";
echo $hash1 === $hash2 ? "Same hash\n" : "Different hashes\n";
var_dump(password_verify('correct horse battery staple', $hash1));
var_dump(password_verify('Correct horse battery staple', $hash1));

<?php
// register.php
require __DIR__ . '/db.php';
$errors = [];
$email = strtolower(trim($_POST['email'] ?? ''));

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $password = $_POST['password'] ?? '';
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = 'Enter a valid email.';
    if (strlen($password) < 10) $errors[] = 'Use at least 10 characters for your password.';

    if (!$errors) {
        try {
            $stmt = $pdo->prepare('INSERT INTO users (email, password_hash) VALUES (?, ?)');
            $stmt->execute([$email, password_hash($password, PASSWORD_DEFAULT)]);
            session_regenerate_id(true);
            $_SESSION['user_id'] = (int)$pdo->lastInsertId();
            header('Location: account.php');
            exit;
        } catch (PDOException $e) {
            if ($e->errorInfo[1] === 1062) {
                $errors[] = 'An account with that email already exists.';
            } else {
                throw $e;
            }
        }
    }
}

<?php
// login.php
require __DIR__ . '/db.php';
$error = null;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $email = strtolower(trim($_POST['email'] ?? ''));
    $stmt = $pdo->prepare('SELECT id, password_hash FROM users WHERE email = ?');
    $stmt->execute([$email]);
    $user = $stmt->fetch();

    if ($user && password_verify($_POST['password'] ?? '', $user['password_hash'])) {
        session_regenerate_id(true);
        $_SESSION['user_id'] = $user['id'];
        if (password_needs_rehash($user['password_hash'], PASSWORD_DEFAULT)) {
            $pdo->prepare('UPDATE users SET password_hash = ? WHERE id = ?')
                ->execute([password_hash($_POST['password'], PASSWORD_DEFAULT), $user['id']]);
        }
        header('Location: account.php');
        exit;
    }
    $error = 'Email or password is incorrect.';
}

// logout.php (reached by a POST form)
$_SESSION = [];
setcookie(session_name(), '', time() - 3600, '/');
session_destroy();
header('Location: login.php');
exit;