View difference between Paste ID: w0kP15fr and UG1wfkFe

 <?php
 	$username = $_REQUEST["txt_username"];
 	$password = $_REQUEST["txt_password"];
 
 	$host = "127.0.0.1";
 	$user = "root";
 	$pass = "12157114";
 
 	try {
 		$dbh = new PDO("mysql:host=$host;dbname=logansarchive", $user, $pass);
 	}
 	catch(PDOException $e) {
 		echo $e->getMessage();
 	}
 
 	$hashed_pass = substr(sha1($password), 0, 10);
 
-	$sql = "select * from admin where adminname = '".$username."' and password = '".$hashed_pass."'";
+	$sql = "select * from admin where adminname = :name and password = :pass";
 	//echo $sql."<br />Count: ";
 	$result = $dbh->prepare($sql);
 
 	$result->bindParam(":name", $username);
 	$result->bindParam(":pass", $hashed_pass);
 
 	$result->execute();
 	$count = $result->fetchAll();
 
 	//$link = mysql_connect($host, $user, $pass);
 	//mysql_select_db("logansarchive", $link);
 	//$result = mysql_query("select * from admin where adminname = '".$username."' and password = '".$hashed_pass."'", $link);
 	//$numrows = mysql_num_rows($result);
 
 	//$link = null;
 	//$result = null;
 
 	if ($count == 1) {
 			foreach ($dbh->query($sql) as $row) {
 			$_SESSION["adminid"] = $row["adminid"];
 			$_SESSION["adminname"] = $row["adminname"];
 			$_SESSION["lastlogin"] = $row["lastlogin"];
 		}
 		header("Location: /logansarchive/admin/index.php");
 	}
 	else {
 		header("Location: /logansarchive/admin/login.php?login_attempt=1");
 	}
 ?>