PHP login

<?php
  $error = '';
  if($_POST){
    $username = $_POST['username'];
    $password = $_POST['password'];

    $stmt = $dbh->prepare("SELECT * FROM tbl_settings WHERE username = :username AND password = :password LIMIT 1");
    $stmt->bindParam(':username', $username);
    $stmt->bindParam(':password', $password);
    $stmt->execute();
    $result = $stmt->fetch();
    if($result){
      $_SESSION['userLoggedIn'] = 2;
      header('location: index.php');
    }else{
      $error = 'Incorrect username or password.';
      $_SESSION['userLoggedIn'] = 1;
    }
  }
?>