Sintak Login dengan Prepared Statement pada PHP

<?php

if(isset($_POST['login'])) {
    $id_user = $_POST['id_user'];
    $pass = md5($_POST['pass']);

    try {
        $sql = "SELECT * FROM tbuser WHERE id_user = :id_user AND pass = :pass";
        $stmt = $db->prepare($sql);
        $stmt->bindParam(':id_user', $id_user);
        $stmt->bindParam(':pass', $pass);
        $stmt->execute();

        $count = $stmt->rowCount();
        if($count == 1) {
            header("location: index.php");
            return;
        }else{
            echo "ID. User dan Password salah !";
        }
    }catch(PDOException $e) {
        echo $e->getMessage();
    }
}

?>