PHP page to edit a user account information and avatar
Security

Possibly Broken Authentication

if(!$user-&gt;is_logged_in()) { 
    redirect('login.php');
} 

[do important stuff]


Make sure that redirect dies. The header redirect you do use doesn't, and if the one of redirect doesn't either, an attacker could easily bypass this check, as a client does not have to follow a header redirect if they do not want to.

Possibly SQL Injection

You mostly use prepared statements, which is good. It's a bit surprising that you do not always use them though:

$edit = $db-&gt;prepare("UPDATE members SET user_avatar = :avatar WHERE username ='" . $_SESSION['username'] . "'");


Depening on your - current or future - limitations on username, this is open to SQL injection. You really should always use prepared statements, even if you think the data may be safe. If you need to think about this each time, you will eventually make a mistake.

Misc


your indentation is off, making your code harder to read.
you have quite a lot of comments which only describe what the code does. Most of them can simply be removed, others seem to be there for structuring your code (AVATAR, choosing the avatar, etc). Instead, add more classes/files and functions. Eg you could have a Avatar class, which has a function uploadAvatar (uploadAvatar would likely use a more generic uploadImage or uploadFile function stored in a more generic class).
your code is quite deeply nested, making it hard to read. If you follow the advice of adding more functions, you will already greatly reduce the nesting. Additionally, return early. So if you have checks at the beginning of a function, don't do if (cond) [do the complex thing], but instead if (!cond) return; [newline] [do the complex thing] (instead of just returning, you could return true/false, an error message, throw an exception, etc.
Error... is not a very informative error message.