$db = new PDO('mysql:host=localhost;dbname=iniection', 'root', '');

$stmt = $db->prepare("SELECT * FROM user WHERE username=? AND password=?");
$stmt->execute(array($_POST['username'], $_POST['password']));