PHP/SQLite Accepting Incorrect Post Values - php

Question

I am creating a simple PHP login system using SQLite, when when the user posts the the HTML form, the system guides them to the "members only page" regardless of what they entered. Here is my form processing code:
<?php
$username = $_POST["username"];
$password = $_POST["password"];
$database = new PDO("sqlite:database.sqlite");
$result = $database -> query("SELECT COUNT (*) FROM accounts WHERE username = '$username' AND password = '$password'");
if ($result > 0)
{
setcookie("session", "Cool", time()+3600);
header("location:index.php");
}
else
{
echo "Failure";
}
?>
Help!

Answer 1

I think it should be...
if ($result->rowCount() > 0) ...
AND: use prepared statements to avoid SQL-injection, don't store uncrypted passwords in your DB, it's a huge security-problem.

Answer 2

Try this (You shouldn't need count, just a simple logical statement):
$query = "SELECT * FROM accounts WHERE username = :username AND password = :password";
$stmt = $database->prepare($query);
$stmt->execute(array(":username"=>$username, "password"=>$password));
$result = $stmt->fetch(PDO::FETCH_ASSOC);
if($result)
{
//Success
setcookie("session", "Cool", time()+3600);
header("location:index.php");
}
// Not successful.
return null;