Passwords are stored and compared in plaintext across auth flows

[codeCraft-Ritik]

Summary:

Registration stores plaintext passwords, and login compares raw input directly against DB values. No hashing is used.

Description:

Multiple files insert password directly from POST and compare pass with row password fields as plain text. This violates basic authentication security requirements.

Steps to Reproduce:

1. Register new patient/doctor account.
2. Inspect DB record for created account.
3. Password appears in plain text.
4. Login path compares plain string against DB field.

Expected:

Passwords should be hashed (for example password_hash/password_verify), never stored plaintext.

Actual:

Passwords are saved and checked as raw strings.

Impact:

Critical security risk: credential disclosure, account takeover, compliance violations.

Suggested Labels:

security, authentication, high priority