Как создать защищенную авторизацию на сайте

<?php require_once("includes/connection.php"); ?>
<?php session_start(); ?>
 
    <?php require_once("includes/connection.php"); ?>
    <?php include("includes/header.php"); ?>
    <?php
 
    $banneduser="0";
    $newuser="1";
    $olduser="2";
 
    if(isset($_SESSION["session_username"])){
    header("Location: intropage.php");
    }
 
    if(isset($_POST["login"]))
 
    if(!empty($_POST['username']) && !empty($_POST['password'])) {
    $username=htmlspecialchars($_POST['username']);
    $password=htmlspecialchars($_POST['password']);
    $username=mysqli_real_escape_string($link, $username);
    $password=mysqli_real_escape_string($link, $password);
    $query=mysqli_query($link, "SELECT * FROM usertb WHERE username='".$username."'");
    $row=mysqli_fetch_assoc($query);
    if(!$row['passhash'] OR password_verify($password, $row['passhash'])!==true){
        echo "Invalid username or password!";
 }elseif(password_verify($password, $row['passhash'])===true){
        if($row['privilege'])===$newuser{
        $_SESSION['session_username']=$username;
        header("Location: introepage.php");
 }elseif($row['privilege'])===$olduser{
      $_SESSION['session_username']=$username;
      header("Location: introfpage.php");
 }elseif($row['privilege'])===$banneduser{
      $_SESSION['session_username']=$username;
        header("Location: banpage.php");
 }
 }
 } else {
    $message = "All fields are required!";
 }
 
 ?>
<?php include("includes/header.php"); ?>

<?php require_once("includes/connection.php"); ?>
<?php
 
    if(isset($_POST["register"])){
 
    if(!empty($_POST['full_name']) && !empty($_POST['username']) && !empty($_POST['password'])) {
 $full_name= htmlspecialchars($_POST['full_name']);
 $username=htmlspecialchars($_POST['username']);
 $password=htmlspecialchars($_POST['password']);
 $username=mysqli_real_escape_string($link, $username);
 $password=mysqli_real_escape_string($link, $password);
 $full_name=mysqli_real_escape_string($link, $full_name);
 $passhash=password_hash($password, PASSWORD_DEFAULT);
 $privilege="1";
 $query=mysqli_query($link, "SELECT * FROM usertb WHERE username='".$username."'");
  $numrows=mysqli_num_rows($query);
if($numrows==0)
   {
    $sql="INSERT INTO usertb (full_name, username, passhash, privilege) VALUES ('$full_name', '$username', '$passhash', '$privilege')";
  $result=mysqli_query($link, $sql);
 if($result){
    $message = "Account Successfully Created";
} else {
 $message = "Failed to insert data information!";
  }
    } else {
    $message = "That username already exists! Please try another one!";
    }
    } else {
    $message = "All fields are required!";
    }
    }
    ?>
 
<?php if (!empty($message)) {echo "<p class='error'>" . "MESSAGE: ". $message . "</p>";} ?>
<?php include("includes/header.php"); ?>