$stmt=$dbh->prepare("SELECT * from users where username=? and password=?");
$stmt->bindValue(1, $user, PDO::PARAM_STR);
$stmt->bindValue(2, $password, PDO::PARAM_STR);
$stmt->execute();