SQLSTATE[HY000]: General error with PHP and PDO -

i have little login script.

function login($sql) { try {                        $fbhost = "localhost";     $fbname = "foodbank";     $fbusername = "root";     $fbpassword = "";     $dbh = new pdo("mysql:host=$fbhost;dbname=$fbname",$fbusername,$fbpassword);     $dbh->setattribute(pdo::attr_errmode, pdo::errmode_exception);      $sth = $dbh->query($sql);            $sth->setfetchmode(pdo::fetch_assoc);      session_start();             if ($row = $sth->fetch()) {         $_session['username'] = "$row[username]";         header("location:index.php");        } } catch(pdoexception $e) {     echo $e->getmessage(); } } 

edits:

index.php

$sql = "select username users username = ". $_post['username'] ." , password = ". $_post['password'] .""; login($sql); 

changed above insert select query. new error: sqlstate[42s22]: column not found: 1054 unknown column 'pvtpyro' in 'where clause'

based on latest edit: can't fetch results pdo after executing insert query. see here: http://www.php.net/manual/en/pdostatement.fetch.php#105682

edit: suppose, since function's called "login", want have $sql: "select password users username = :username", , iterate on results while loop, , log in user if password matches?

edit2: based on edit provide select query: do not use query. doing not sql injection proof. never ever use variables user input (i.e. $_post, $_get et al) , put them unfiltered sql query. please term "prepared statements" here @ or google. can see, since forgot put single ticks (apostrophes) before , after double quotes, mysql thinks input refers column ("pvtpyro") instead of comparing value in column against string. use ":username", ":password" syntax (the 1 prepended colons) or queries unsafe , enormously dangerous application.