``` The login page above specifically checks for: ```javascript $(data).hasClass("login-success") ``` and then redirects to: ```javascript window.location.href = "home.php"; ``` So your complete flow is now: ```text login.php ↓ AJAX POST ↓ signin.php ↓ password_verify() ↓ Session created ↓ login-success response ↓ home.php ``` And your `signin.php` is already correctly using the more secure: ```php password_verify($password, $row['password_hash']) ``` so **do not change it to MD5**. One small cleanup I recommend in `signin.php`: you're selecting `fcm_token`, but you're not using it. You can remove `fcm_token` from the `SELECT` unless you plan to update the FCM token during login.