Sistema de login en PDO

CREATE TABLE IF NOT EXISTS `user` (
  `id` mediumint(9) NOT NULL AUTO_INCREMENT,
  `username` varchar(20) NOT NULL,
  `password` varchar(60) NOT NULL,
  `date` varchar(19) NOT NULL,
  `ip` varchar(10) NOT NULL,
  PRIMARY KEY (`id`)
)

<?php
    $connection = new PDO("mysql:host=hosting;dbname=base de dato","usuario","contraseña");
    $connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
?>

<?php
session_start();
include('/config/index.php');

if(isset($_SESSION['username'])):
    echo 'Estas logeado <a href="/logout.php">Logout</a>';
else:
    if(isset($_POST['login'])):
	    if(empty($_POST['username']) || empty($_POST['password'])):
		    echo 'No dejes campos en blanco';
		elseif(strlen($_POST['username']) > 20):
		    echo 'El usuario no puede tener mas de 20 caracteres';
		elseif(strlen($_POST['password']) > 20):
		    echo 'La contraseña no puede tener mas de 20 caracteres';
		else:
            $login = $connection->prepare("SELECT username FROM user WHERE username = :username AND password = :password");
            $login->bindParam(':username',$_POST['username']);
            $login->bindParam(':password',crypt($_POST['password'], '$2a$07$rieh3693fjarjeuf38cw27fg2$'));
            $login->execute();
            if($login = $login->fetch(PDO::FETCH_ASSOC)):
			    $_SESSION['username'] = $_POST['username'];
                header('Location: /');
            else:
                echo 'Datos incorrectos';
            endif;
		endif;
	endif;
	echo '<form action="" method="post">
        <input name="username" placeholder="Username"><br>
	    <input name="password" placeholder="Password"><br>
	    <input name="login" type="submit">
    </form>
	
	<a href="/register.php">Registrate</a>';
endif;
?>

<?php
session_start();
include('/config/index.php');

if(isset($_SESSION['username'])):
    header('Location: /');
else:
    if(isset($_POST['register'])):
	    if(empty($_POST['username']) || empty($_POST['password'])):
		    echo 'No dejes campos en blanco';
		elseif(strlen($_POST['username']) > 20):
		    echo 'El usuario no puede tener mas de 20 caracteres';
		else:
		    $user = $connection->prepare("SELECT username FROM user WHERE username = :username");
			$user->bindParam(':username',$_POST['username']);
			$user->execute();
		    if($user->fetch(PDO::FETCH_ASSOC)):
		        echo 'El usuario ya existe';
		    elseif(strlen($_POST['password']) > 20):
		        echo 'La contraseña no puede tener mas de 20 caracteres';
		    elseif($_POST['password'] <> $_POST['password2']):
		        echo 'Las contraseñas no coinciden';
		    else:
		        $register = $connection->prepare("INSERT INTO user(id,username,password,date,ip) VALUES ('',:username,:password,'".date('H:i:s d/m/Y')."','".$_SERVER['REMOTE_ADDR']."')");
				$register->bindParam(':username',$_POST['username']);
				$register->bindParam(':password',crypt($_POST['password'], '$2a$07$rieh3693fjarjeuf38cw27fg2$'));
				$register->execute();
				if($register->rowCount() > 0):
				    $_SESSION['username'] = $_POST['username'];
				    header('Location: /');
				else:
				    echo 'Ha ocurrido un error';
				endif;
		    endif;
		endif;
	endif;
	echo '<form action="" method="post">
        <input name="username" placeholder="Username"><br>
	    <input name="password" placeholder="Password"><br>
		<input name="password2" placeholder="Vuelve a ingresar la contraseña"><br>
	    <input name="register" type="submit">
    </form>';
endif;
?>

<?php
    session_start();
    session_destroy();
    header('Location: /');
?>