Uuuuuh.... Why is you password of type
int(50) in your database (and not varchar(50)) ???

That throws of the whole check on "password=:password" part in the SQL

Now only real-numbers are checked. And your "sdhjfhkahfhjfkahkjdsf"-password
evaluates to 0 (because it's seen as a variable) so it's always true.
Change your password to a varchar(50) and the SQL should do the check just fine.