Untitled

<?php

if($_SERVER['REQUEST_METHOD'] == 'POST') {
$usuario = $_POST['usuario'];
$senha = $_POST['senha'];

$root = 'root';
$password= '1111';
$conn = new PDO('mysql:host=localhost;dbname=fail', $root, $password);

$sql = "SELECT * FROM login WHERE usuario=:usuario AND senha=:senha;";
      $stmt = $conn->prepare( $sql );
      $stmt-> bindParam( ':usuario', $usuario );
      $stmt-> bindParam( ':senha', $senha );
      $stmt->execute();
      $result = $stmt->fetchAll();

if (count($result)) {
    header("location: admin2.php");
}
else {
    throw new Error($stmt->errorInfo());

}
}

?>

<!DOCTYPE html>
<html>
<head>
<title>SQL Injection</title>
</head>
<body>
<form action="index2.php" method="POST">
<h1>SQL Injection - Teste</h2><br>
Usuário:<br>
<input type="text"
name="usuario"<br><br>
Senha:<br>
<input type="text"
name="senha"<br><br>
<input type="submit" value="Login">
</Form>
</body>
</html>