Update login.php

Edited queries to use prepared statements with PDO to prevent SQL injections.