The elephant in the room is what you return when you SELECT.<p>My POV is you should be able to verify user sign-in with something like &quot;SELECT COUNT(*) FROM users WHERE email = &#x27;maaku@hellokitty.com&#x27; AND password=&#x27;hunter2&#x27;;&quot;, which has the added bonus of not informing the client whether the query failed because the user didn&#x27;t exist, or because the  password was wrong. Imho, all queries for the column content should simply fail.