Custom login system (PDO, sanitizing, hash) I have made a custom login form for my site, with the help of PDO (until now I used simple MySQL connection and sanitizing), and it looks like this:

session_name('NEWCOOKIE');
session_start();

require_once "config.php";

$member_username = $_POST['username']; 
$member_password = $_POST['password'];
    $crypt_pass = crypt($member_password,"somesalt");

try{
    $dbh = new PDO('mysql:host=localhost;dbname='.DB_NAME, DB_USERNAME, DB_PASS, array(PDO::MYSQL_ATTR_INIT_COMMAND =&gt; "SET NAMES utf8"));
    $dbh-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} 
catch (PDOException $e) {
    echo "Fatal error.";
    file_put_contents('PDOErrors.txt', $e-&gt;getMessage(), FILE_APPEND);
}    

$sth = $dbh-&gt;prepare("SELECT * FROM ".DB_PREFIX."_users WHERE username = :user AND password = :pass");
$sth-&gt;bindParam(':user', $member_username);
$sth-&gt;bindParam(':pass', $crypt_pass);
$sth-&gt;execute();
$total = $sth-&gt;rowCount();
$row = $sth-&gt;fetch();

if($total &gt; 0){
    if($row['activated']){
        $_SESSION["user_username"] = $member_username;
        $_SESSION["user_logedIn"] = true;
        $_SESSION["user_id"] = $row['user_id'];
        $_SESSION["timeout"] = time();
        header("location: index.php");    
    }
    else{
        echo "ACCOUNT NOT ACTIVE";
    }
}
else{
    echo "WRONG PASSWORD OR USERNAME";
}


Is this safe? I know that nothing is 100% safe, but I have a small number of users (around 200-300), and 1000 visitors a month, so I don't expect very "professional" attacks and programming experts. 

My questions are:


As you can see, I don't use sanitizing at all.  I thought that PDO will do that part of the job, or I am wrong?
I hope that crypting of password is good (with no MD5 or SHA, is crypt() recommended)?
File config.php contains username and pass of my database. Should I protect it somehow, what permissions to set?
Any other (serious) problem with this code?
Well, let's see:


You're using PDO and prepared statements, no risk of SQL injection there. Great!
Your PDO code may throw an Exception (Specifically, a PDOException) at any time, so the whole database code block should be kept inside of the try/catch block.
crypt in on itself isn't 100% secure. See This question for more details.
Database credentials are not constant. They can change over time, and you may want to change the server, change the user, add an additional database etc in the near/far future. The solution is to use functions (or better yet, classes) and pass the credentials as variables, rather then applying them as app-wide constants.