Would this login function be secure?
Would this login function be secure, I put the url data straight into the function, but would this be unsafe? Could this be injected, I know it has no SQL, but is it venerable?

    if ($_SERVER["REQUEST_METHOD"] == "POST") {    
        $login = check_login($_POST['emailusername'], $_POST['password']);
        if ($login) {
            // Registration Success
           header("location: /");
        } else {
            // Registration Failed
            echo 'Username / password wrong';
        }
    }


funtion:

    // CHECK LOGIN SCRIPT
       function check_login($emailusername, $password) 
    	{
    
    $host = 'localhost';
    $port = 3306; // This is the default port for MySQL
    $database = 'example';
    $username1 = 'root';
    $password1 = 'root';
    
    $dsn = "mysql:host=$host;port=$port;dbname=$database";
    $db = new PDO($dsn, $username1, $password1);
    		
                    $password = md5($password);
    
    		
    $statement = $db->prepare('SELECT uid FROM users WHERE (email = ? or username = ?) and password = ?');
    $statement->execute(array($emailusername, $emailusername, $password));
    
    if ($result = $statement->fetchObject()) {
        $_SESSION['login'] = true;
        $_SESSION['uid'] = $result->uid;
        return TRUE;
    }else{
        return FALSE;
    }    }
Would this login function be secure?
===

Would this login function be secure, I put the url data straight into the function, but would this be unsafe? Could this be injected, I know it has no SQL, but is it venerable?

    if ($_SERVER["REQUEST_METHOD"] == "POST") {    
        $login = check_login($_POST['emailusername'], $_POST['password']);
        if ($login) {
            // Registration Success
           header("location: /");
        } else {
            // Registration Failed
            echo 'Username / password wrong';
        }
    }


funtion:

    // CHECK LOGIN SCRIPT
       function check_login($emailusername, $password) 
    	{
    
    $host = 'localhost';
    $port = 3306; // This is the default port for MySQL
    $database = 'example';
    $username1 = 'root';
    $password1 = 'root';
    
    $dsn = "mysql:host=$host;port=$port;dbname=$database";
    $db = new PDO($dsn, $username1, $password1);
    		
                    $password = md5($password);
    
    		
    $statement = $db->prepare('SELECT uid FROM users WHERE (email = ? or username = ?) and password = ?');
    $statement->execute(array($emailusername, $emailusername, $password));
    
    if ($result = $statement->fetchObject()) {
        $_SESSION['login'] = true;
        $_SESSION['uid'] = $result->uid;
        return TRUE;
    }else{
        return FALSE;
    }    }