SQL Injection fix within login.php

Hopefully this will fix the possible injection?

Signed-off-by: Matthew Rayner <matt@mattrayner.co.uk>