我目前有一个像这样的标准登录表单：

<?php
if( isset( $_POST['username], $_POST['password'] ) ) {
    // escape both strings and compare them to database
}

?>
<form action="" method="post">
    <input type='text' value='username' name='username'></input>
    <input type='password' value='password' name='password'></input>
    <input type='submit' value='submit'></input>
</form>

我想移动到 AJAX，所以新页面不会刷新。这是我的新方法：

<script>
function login_ajax() {
     var formdata = new FormData();
     var ajax = new XMLHttpRequest();
     formdata.append('username', document.getElementById('username').value;
     formdata.append('password', document.getElementById('password').value;
     ajax.open( "POST", "https://my-website.com/login_validation.php" );
     ajax.onreadystatechange = function() {
         if(ajax.readyState == 4 && ajax.status == 200) {
             // do something
         }
    }
    ajax.send( formdata );
}

</script>
?>
<form action="" method="post" onsubmit='login_ajax(); return false;'>
    <input type='text' value='username' id='username'></input>
    <input type='password' value='password' id='password'></input>
    <input type='submit' value='submit'></input>
</form>

我的login_validation.php样子是这样的：

<?php
if( isset ( $_POST['username'], $_POST['password'] ) ) {
    // escape strings compare to database and sign on

}

第二种方法比第一种安全吗？