Php connexion en sql que le 1er pseudo valide

<?php

if(!isset($_POST['user']))
{
echo "<form action='?' method='post'>\n
Pseudo :<br /><input type='text' name='user' /><br />\n
Mot de passe :<br /><input type='password' name='password' /><br />\n
<input type='submit' value='Connexion' />";
exit;
}

if($_POST['user']=='')
{
echo "Le pseudo est incorrect.<br />\n";
exit;
}

if($_POST['password']=='')
{
echo "Le mot de passe est incorrect.<br />\n";
exit;
}

try
{
$bdd = new PDO('mysql:host=localhost;dbname=connection', 'root', '');
}
catch (Exception $e)
{
        die('Erreur : ' . $e->getMessage());
}

$reponse = $bdd->query('SELECT user FROM users');

while($donnees = $reponse->fetch())
{
    if(preg_match("#".$_POST['user']."#",$donnees['user']))
    {
    echo "Le pseudo ".htmlspecialchars($_POST['user'])." est correct.<br />\n";
    goto password;
    }
    else
    {
    echo "Le pseudo ".htmlspecialchars($_POST['user'])." est incorrect.<br />\n";
    exit;
    }
}

password:

$reponse->closeCursor();

$reponse = $bdd->query('SELECT password FROM users WHERE user=\''.$_POST['user'].'\'');

while($donnees = $reponse->fetch())
{
    $md5 = md5($_POST['password']);
    
    if(preg_match("#".$md5."#",$donnees['password']))
    {
    echo "Le mot de passe est correct.<br />\n";
    goto suite;
    }
    else
    {
    echo "Le mot de passe est incorrect.<br />\n";
    exit;
    }
}

suite:
    
$reponse->closeCursor();

echo "Vous êtes maintenant connecté.<br />\n";

?>