Preventing SQL Injection in Login Page in PHP [duplicate]

Answer 1

missing connection variable $con

$query=mysqli_prepare($con,"select user_id from users where user_name= ? and 
password= ? ");      

and change this too

$query->bind_Param("ss", $unsafe_username, $unsafe_password);
           ^^^ 

Answer 2

You have to add $con variable in the prepare function

$query=mysqli_prepare($con,"SELECT user_id FROM users WHERE user_name= ? AND password= ? ");

Answer 3

The procedural style of mysqli_prepare expects the first parameter to be the connection variable and second one to be the string (query).

Change

mysqli_prepare("select user_id from users where user_name= ? and password= ? ");

to

mysqli_prepare($conn, "select user_id from users where user_name= ? and password= ? ");

Read documentation here.