Provide example PDO code for security

Here is an example of some PDO code that is significantly more secure than using $_POST in your query string. The HiProject application is critically insecure if this code is used in production - one could easily send a malicious $_POST variable to login.php (for example, send the string: ' OR 1;  and gain access to your data, impersonating any user they wish.

That's a huge problem!