$query = "select * from login where username = '".$username."' and password = '".$password."'";
$stmt = $db->prepare($query);
$stmt->bindParam(1, $username);
$stmt->bindParam(2, $password);
$stmt->excute();
$user = $row['username'];
$pass = $row['password'];