This method should be rewritten. First we check whether two passwords match. If they don't we immediately redirect the user to a error page and don't hit the database. 
Then we check if a user with entered login exists. Again, we search him only by login, not by login and password entered two times. And only then we show a page about successful registration.