title: trying to build secure login with php
body: <p>I need to implement for current project some secure login in php.
  I wrote something with pdo prepared statements with old code having in mind. I need advices to implement more secure maybe, or to examine is it proof to sql inj, attacks.</p>
  
  <pre><code> &lt;form action="validate.php" method=post&gt;
      &lt;table class="loginForm"&gt;
         &lt;thead&gt;&lt;/thead&gt;
         &lt;tbody&gt;
            &lt;tr&gt;
              &lt;td&gt;UserName:&lt;/td&gt;
              &lt;td&gt;&lt;input name=user_name&gt;&lt;/td&gt;
            &lt;/tr&gt;
            &lt;tr&gt;
             &lt;td&gt;Pass:&lt;/td&gt;
             &lt;td&gt;&lt;input type=password name=password&gt;&lt;/td&gt;
            &lt;/tr&gt;
            &lt;tr&gt;
             &lt;td&gt;&lt;input class=loginBtn type=submit value='Log me in' name=login&gt;&lt;/td&gt;
           &lt;/tr&gt;
         &lt;/tbody&gt;
      &lt;/table&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>Validate.php</p>
  
  <pre><code>session_start();    
  try {
      $host = 'localhost';
      $dbName = 'xxx';
      $dbUser = 'xxx';
      $dbPass = 'xxx';
      # MySQL with PDO_MYSQL  
      $DBH = new PDO("mysql:host=$host;dbname=$dbName", $dbUser, $dbPass);
      $DBH-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
  } catch (PDOException $e) {
      echo "I'm afraid I can't do that.";
      file_put_contents('PDOErrors.txt', $e-&gt;getMessage(), FILE_APPEND);
  }
  
  $STH = $DBH-&gt;prepare("SELECT * FROM `Admins` WHERE `username` = '$user_name' AND password='$password'");
  $STH-&gt;execute();
  
  $STH-&gt;setFetchMode(PDO::FETCH_ASSOC);
  $affected_rows = $STH-&gt;fetchColumn();
  
  if($affected_rows == 1) {
      //add the user to our session variables
      $_SESSION['username'] = $user_name;
      header("Location: http://www.mysite.com/administration/index.php");
          exit;
          //print 'allowed';
          }
      else {
          print 'access is not allowed !!!';
      }
  </code></pre>
  
  <p>Updated:
  Thanks to accepted answer bellow my query is coded now like this</p>
  
  <pre><code>$STH = $DBH-&gt;prepare('SELECT * FROM Admins 
                        WHERE username = :user and password = :pass');
  $STH-&gt;execute(array(':user' =&gt; $_POST['user_name'], 
                      ':pass' =&gt; $_POST['password']));
  </code></pre>
  
  <p>Which is fine. 
  Now I just want to be sure is my authentication is good enough to use it on admin pages like this
  session_start();</p>
  
  <pre><code>try {
      $host = 'xx';
      $dbName = 'xxxx';
      $dbUser = 'xxxxx_first';
      $dbPass = 'xxx';
      # MySQL with PDO_MYSQL  
      $DBH = new PDO("mysql:host=$host;dbname=$dbName", $dbUser, $dbPass);
      $DBH-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
  } catch (PDOException $e) {
      echo "I'm afraid I can't do that.";
      file_put_contents('PDOErrors.txt', $e-&gt;getMessage(), FILE_APPEND);
  }
  
  if (empty($_SESSION['username'])) {
      die('To access pages you have to be loged in.
      &lt;a href="/administration/login.php"&gt;log in&lt;/a&gt; ');
  
  }
  </code></pre>