diff --git a/php/cookies_and_access_control/addUser.php b/php/cookies_and_access_control/addUser.php
index bc91854..8475276 100644
--- a/php/cookies_and_access_control/addUser.php
+++ b/php/cookies_and_access_control/addUser.php
@@ -2,10 +2,15 @@
      $userName = $_POST["uName"];
      $password = $_POST["myPassword"];
 
-     $pdo = new PDO('mysql:host=192.168.64.2;db=lab10', 'lab10', 'lab10');
+     // Hash the password securely
+     $hashedPassword = password_hash($password, PASSWORD_DEFAULT);
 
-     $queryString = "INSERT INTO 'users' ('username', 'password') VALUES ('".$userName."','".$password."')";
+     $pdo = new PDO('mysql:host=192.168.64.2;db=lab10', 'lab10', 'lab10');
 
+     // Use prepared statements with parameter binding to prevent SQL injection
+     $queryString = "INSERT INTO users (username, password) VALUES (:username, :password)";
      $result = $pdo->prepare($queryString);
+     $result->bindParam(':username', $userName);
+     $result->bindParam(':password', $hashedPassword);
      $result->execute();
 ?>
\ No newline at end of file
diff --git a/php/cookies_and_access_control/doLogin.php b/php/cookies_and_access_control/doLogin.php
index 658fb54..76c3cf9 100644
--- a/php/cookies_and_access_control/doLogin.php
+++ b/php/cookies_and_access_control/doLogin.php
@@ -29,15 +29,20 @@
      */
 
      $pdo = new PDO('mysql:host=192.168.64.2;db=lab10', 'lab10', 'lab10');
-     $queryString = "SELECT * FROM users WHERE username = '".$userName."'";
 
+     // Use prepared statements to prevent SQL injection
+     $queryString = "SELECT * FROM users WHERE username = :username";
      $result = $pdo->prepare($queryString);
+     $result->bindParam(':username', $userName);
      $result->execute();
+
      $validUser = False;
 
-     for ($i=0; $row = $result->fetch(); $i++) {
-          if ($row['password'] === $password) {
+     while ($row = $result->fetch(PDO::FETCH_ASSOC)) {
+          // Verify password using password_verify instead of plaintext comparison
+          if (password_verify($password, $row['password'])) {
                $validUser = True;
+               break; // Password matched, no need to keep checking
           }
      }
 
diff --git a/php/cookies_and_access_control/lab10.sql b/php/cookies_and_access_control/lab10.sql
index dac7859..36dc78e 100644
--- a/php/cookies_and_access_control/lab10.sql
+++ b/php/cookies_and_access_control/lab10.sql
@@ -30,7 +30,7 @@ SET time_zone = "+00:00";
 
 CREATE TABLE `users` (
   `username` varchar(50) NOT NULL,
-  `password` varchar(50) NOT NULL
+  `password` varchar(255) NOT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=latin1;
 
 --
@@ -38,7 +38,7 @@ CREATE TABLE `users` (
 --
 
 INSERT INTO `users` (`username`, `password`) VALUES
-('testtesttest', 'hello');
+('testtesttest', '$2y$10$xNNaJ0UZqqxa8mHgy2e.7.KWaMGEIsZFmRb.FZQ5pzvSMWXH1/A1G');
 COMMIT;
 
 /*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;