I'm VERY new to PHP and have begun writing a basic login for a website that uses data from a Microsoft SQL server to display information on the web.  Below are 3 snippets of code (two functions from the same file and one controller file that calls them.)Connect to MSSQL to validate user (from phplib)With this, I take the login credentials stored in a MySQL database, and use them to connect to a MSSQL database. (As seen in the createUser case of the controller).function PDOConn(&$IPAddress, &$userAdmin, &$passAdmin, &$Database, $sess_client){    global  $host,             $username,             $password,             $db_name,             $tbl_name_client;    try {              $conn = new PDO(mysql:host=$host; dbname=$db_name, $username, $password);             $stmt = $conn -> prepare(SELECT    stuff                                      FROM $tbl_name_client                                       WHERE client = :clientId);            $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);            $stmt->execute(array('clientId' => $sess_client));            $result = $stmt->fetchAll();                if ( count($result) == 1 )                     {                        foreach($result as $row)                             {                                $IPAddress = $row['IP'];                                $userAdmin = $row['Username'];                                $passAdmin = $row['Password'];                                  $Database  = $row['database'];                            }                    }                 else if (count($result) > 1)//Primative error handling                    {                        exit( <h1>There are multiple rows in the clients table with the same clientID, which is really strange...</h1>);                    }                else                      {                        exit( <h1>ID isn't in the table.  No rows returned.  Sorry bro...);                    }        }      catch(PDOException $e)         {              echo 'ERROR:   '. $e->getMessage();          }   }Check Function (from phplib)This is the function that get called from the main login screen.    function PDOCheckLogin($myusername, $mypassword)    {        global $host,                $username,                $password,                $db_name,                $tbl_name;    try {              $conn = new PDO(mysql:host=$host; dbname=$db_name, $username, $password);             $stmt = $conn->prepare(SELECT * FROM $tbl_name WHERE username = :myusername);            $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);            $stmt->execute(array('myusername' => $myusername));            $result = $stmt->fetchAll();                if ( count($result) == 1 )                     {                        foreach($result as $row)                             {                                $validpass = $row['password'];                                $hashsalt  = substr($validpass, 0, 128); //get the salt from the front of the hash                                $testhash  = hash('sha512', $hashsalt.$mypassword);                                $testhash  = $hashsalt.$testhash;                                if($testhash === $validpass)                                    {                                        $sess_empno    = $row['employeeno'];                                        $sess_client   = $row['ClientId'];                                        $sess_username = $row['username'];                                        $_SESSION['sess_empno']    = $sess_empno;                                        $_SESSION['sess_client']   = $sess_client;                                        $_SESSION['sess_username'] = $sess_username;                                        header(location:../index.php);                                    }                                else                                    {                                        exit(<h1>WRONG PASSWORD >:(</h1>);                                    }                            }                     }                else if (count($result) > 1)                    {                        exit( <h1>There are multiple users with that username in the database...Whoops...</h1>);                    }                else                      {                        exit( <h1>That's not a username...</h1>);                    }        }      catch(PDOException $e) {              echo 'ERROR:   '. $e->getMessage();          }   }My...Well Whatever this is...Controller I guess.This receives posts from various forms and then calls the correct functions.<?phpob_start();include_once('../phplib.php'); session_start(); $form = $_POST['form']; switch ($form) {    case 'login':  //When the User Logs in             $myusername=$_POST['myusername'];              $mypassword=$_POST['mypassword'];                PDOCheckLogin($myusername, $mypassword);//Do this function        break;    case 'createUser':  //MSSQL verification for the user for user creation            $client=$_POST['clientId'];             $email=$_POST['email'];                PDOConn($IPAddress, $userAdmin, $passAdmin, $Database, $client);//Get the login credentials from the database                    $Login = $userAdmin;                    $Password = $passAdmin;                $conn=mssql_connect($IPAddress,$Login,$Password); //Connect to the database                    if (!$conn )                    {                          die( print_r(Unable to connect to server, true));                    }                mssql_select_db($Database, $conn);                    $sql=SELECT stuff FROM table WHERE email = '$email'; //Make sure your email is in the MSSQL database                    $rs=mssql_query($sql);                    $count=mssql_num_rows($rs);                         if ($count == 0 || $count > 1)                         {                            echo(Email Not Found or Valid);//You liar...                         }                         else{                              while ($row = mssql_fetch_array($rs))                                  {                                     $EmpNo = $row['employee_number'];                                    }                             }                PDONewUser($EmpNo, $email, $client, $tempSess);        break;    default:        # code...        break; }ob_end_flush();?>I'm not thrilled with the state of my mssql_connect() code but I really don't know the alternative as the PDO drivers are extremely complicated and, from what I gather, experimental.I salt my passwords (so I'm ahead of LinkedIn) but that's about it.  I'm looking into measures to stop Brute force and XSS but I want to make sure this isn't completely broken first.  Is this secure?  Is there a better way to be doing thing?  OOP probably would be a smart move but I really do struggle with the concepts.  I wrote my first line of HTML code in February of this year and had no real computer experience prior to that.My Controller file currently points to 5 different cases (better than my old approach of five files point to different functions, which in turn was better than 5 files that didn't even have functions, they just ran procedural code and then redirected as necessary.)  Is that bad coding?Any suggestions would be great.  
PHP Login/User Creation Validation Function
php;object oriented;security;sql server