So when I try to verify login username and password, would I want to attempt to connect to the database using those login information? or using the root/administrator/super-user username and password?
I heard doing the latter may result in holes in security but I'm not sure how else to verify the login information unless mysqli_connect provides an error code when the database connection cannot be established due to invalid username/password fields...
You should be using whatever username and password you've configured database access for, using CREATE USER and GRANT commands in the database management system. It's unlikely that every application user has their own account in the database system as well. Your database administrator should be able to tell you the appropriate user and password for your application. (If you're the DBA, I think you need to bone up...)
Don't use an mysqli_connect, use a PDO connection to connect to your database and store it in a folder with a htaccess file that blocks anyone getting access to it. Something like the below should do it:
<?php
try {
$pdo = new PDO('mysql:host=188.121.44.140;dbname=yourdatabasename', 'yourdatabasename', 'yourpassword');
} catch (PDOException $e) {
exit('Database error.');
}
?>
