Код-ревью: вход и профиль на чистом PHP

<?php
session_start();
$pdo = new PDO('mysql:host=db;dbname=app', 'root', 'root');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $email = $_POST['email'];
    $sql = "SELECT * FROM users WHERE email = '$email'";
    $user = $pdo->query($sql)->fetch();
    if ($user && md5($_POST['password']) === $user['password']) {
        $_SESSION['user_id'] = $user['id'];
        header('Location: /profile.php?id=' . $user['id']);
        exit;
    }
    echo "Неверный пароль для " . $email;
}

// profile.php
$id = $_GET['id'];
$profile = $pdo->query("SELECT * FROM users WHERE id = $id")->fetch();
echo "<h1>Привет, " . $profile['name'] . "</h1>";
echo "<a href='" . $profile['website'] . "'>Сайт</a>";
$prefs = unserialize($_COOKIE['prefs']);