Another newbie here.. I\'m trying to fix below code to prevent sql injection and learn the new way of writing php and sql.
Your kindly advise would be greatly appreciat
You can't mix mysql with mysqli or PDO. You need to look at your error logs because this should not be possible - you should be seeing tons of fatal errors.
public function getUser($uid, $password) {
$stmt = $db->prepare("SELECT * FROM users WHERE id=? AND pswd=?");
$stmt->execute(array($uid, $password));
return $stmt->fetch();
}