Proper class user.php
In terms of the php code itself, the only thing I notice is your use of the $_POST superglobal in your class. This isn't wrong per say but I typically try to avoid use of $_POST in my objects, and instead pass the data in via parameters. Keeping all of your $_POST access in the same place makes it easier to manager changes, especially this the contents of $_POST is so easy to change. Same is also true for $_GET and $_REQUEST.

The same is also kind of true for the $_SESSION variable. It's not as important where it is, but stick to access within a limited set of locations.

Here's a few points to consider in terms of how you've constructed your class. They're not really php things, more good object construction practice.

Make sure you're always returning something from your methods. In many you have a return if things go right, but nothing if things go wrong. This will result in a NULL being returned but it's better practice to define this for reliable and consistent operation.

To take a more MVC approach, and to make your code easier to change and maintain, you shouldn't be echoing your errors in the class. Rather set the message to an error variable that can be retrieved by the calling code if needed, and then return FALSE. Echoing the error as it happens can be good during development but I recommend against it for production. If you still do want to see the error, best to handle it in the calling code so that you can easily change how the error is displayed. You could use a debugMode flag in the class if you want the best of both.

Your code indenting could really be improved.

private function get_user_hash($username){
    try {
        $stmt = $this-&gt;_db-&gt;prepare('SELECT password FROM members WHERE username = :username AND active="Yes" ');
        $stmt-&gt;execute(array('username' =&gt; $username));
        $row = $stmt-&gt;fetch();
        return $row['password'];
    } catch(PDOException $e) {
        echo '&lt;p class="bg-danger"&gt;'.$e-&gt;getMessage().'&lt;/p&gt;';
    }
}


Lastly I recommend using CamelCase for your method names. The use of lowercase and underscores to me is a bit oldschool and more difficult to read.

private function getUserHash($username)