Un problème possible dans une requête MySql Pdo

$sql = "SELECT * FROM membersbase WHERE code = '".$_GET['code']."'";

$code = !empty($_GET['code']) ? $_GET['code'] : NULL;
$sql = "SELECT * FROM membersbase WHERE code = '".$code."'";

$code = !empty($_GET['code']) ? $_GET['code'] : NULL;
$sql = "SELECT * FROM membersbase WHERE code = :code ";
$datas = array(':code'=>$code);
try{
  $sth = $connexion->prepare($sql);
  $sth->execute($datas);
  $row = $sth->fetch();
}catch(Exception $e){
  echo "ERREUR dans la requête <br>".$sql;
  echo "<br> ". $e->getMessage();
}

$new_email = strtolower(trim($_POST['new_email']));

$new_email = !empty($_POST['new_email']) ? strtolower(trim($_POST['new_email'])) : $_POST['new_email'];

 session_start();

// $ registration est défini avant comme $registration = !empty($_POST['registration']) ? $_POST['registration'] : NULL;
// Username = ID
//if (strlen($_SESSION['registration']['user']) < 5 || strlen($_SESSION['registration']['user'] > 20)) {
$username = !empty($_SESSION['registration']['user']) ? strlen($_SESSION['registration']['user']) : NULL;
// ou (? ) je fais plus simple avec	
$username = !empty($registration ['user']) ? strlen($registration ['user']) : NULL;
if (strlen($username) < 5 || strlen($username) >20) {
	$_SESSION['message'] .= "Invalid length user (5-20)<br>";
}

//if ($_SESSION['registration']['day_birthday'] == "--" || $_SESSION['registration']['month_birthday'] == "--" || $_SESSION['registration']['year_birthday'] == "--" ){
$message7 = !empty($_SESSION['registration']['day_birthday']) ? strlen($_SESSION['registration']['day_birthday']) : NULL;
if (strlen($message7) == "--") {
$_SESSION['message'] .= "Invalid Date of Birthday<br>";
}

unset($_SESSION['action']);

// Delete action
$action = !empty($_SESSION['action']) ? $_SESSION['action'] : NULL;
//unset($_SESSION['action']);
unset($action);

session_start();
error_reporting(E_ALL);
require_once ("connexionBDD.php");

<?php require_once __DIR__ ."/../securite.php";?>

<?php
$PARAM_hote = 'localhost';
$PARAM_port = '3306';
$PARAM_nom_bd = 'killidataphpmysql';
$PARAM_utilisateur = 'root';
$PARAM_mot_passe = '';
try {
  $connexion = new PDO('mysql:host=' . $PARAM_hote . ';dbname=' . $PARAM_nom_bd, $PARAM_utilisateur, $PARAM_mot_passe, array(PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES utf8"));
   // Activation des erreurs PDO
  $connexion ->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
  // mode de fetch par défaut : FETCH_ASSOC / FETCH_OBJ / FETCH_BOTH
  $connexion ->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
} catch (Exception $e) {
    echo 'Erreur : ' . $e->getMessage() . '<br />';
    echo 'N° : ' . $e->getCode();
}
?>

session_start();

header('Location: '.$page_login);

header("Location: ".$_SERVER['PHP_SELF']);

<?php
if (session_status() == PHP_SESSION_NONE) {
    session_start();
}
error_reporting(E_ALL);
require_once ("connexionBDD.php");


$user = !empty($_POST['user']) ? $_POST['user'] : NULL;
$sql = "SELECT * FROM membersbase WHERE user LIKE '".trim($user)."' AND active = '1'";

try{
  $sth = $connexion->prepare($sql);
  $sth->execute();
  $row = $sth->fetch();
}catch(Exception $e){
  echo "ERREUR dans la requête <br>".$sql;
  echo "<br> ". $e->getMessage();
}
if ($row) {

	if (password_verify($_POST['password'], $row['password'])) {

		
		foreach ($row as $col => $value) {
			$_SESSION['user'][$col] = $value;
		}

		
		$file_log_access = "log_visitors.txt";

		

		$register = date('Y-m-d H:m:s')."\t";
		$register .= $_SERVER['REMOTE_ADDR']."\t";
		$register .= $_SERVER['HTTP_USER_AGENT']."\t";
		$register .= $_SESSION['user']['Rk_members']."\t";
		$register .= $_SESSION['user']['first_name']." ";
		$register .= $_SESSION['user']['last_name']." (";
		$register .= $_SESSION['user']['country'].")";

		file_put_contents($file_log_access, $register, FILE_APPEND);

		header("Location: ".$_SERVER['PHP_SELF']);		
		exit;	

	} else {

$datas = [':user'=>trim($user)];

header("Location: ".$_SERVER['PHP_SELF']);

if (session_status() == PHP_SESSION_NONE) {
    session_start();
}
error_reporting(E_ALL);
require_once ("connexionBDD.php");

$fileSecurite = "securite.php";
if(!file_exists($fileSecurite)){
  echo ' Fichier ' . $fileSecurite . ' manquant ou mal ortographié !!';
  exit;}

require('headermysql.php');

/************************************************************************/
if (isset($_SESSION['action'])) {
 $_POST['action'] = $_SESSION['action'];
 unset($_SESSION['action']);
}
/************************************************************************/
if (isset($_POST['action'])) {
 switch ($_POST['action']) {

  case "Login":
   require('check_user.php');
   break;

  case "Registration":
   require('form_registration.php');
   break;

  case "Validation":
   require('validation_inscription.php');
   if (isset($_SESSION['message'])) {
    // Redirect
    $_SESSION['action'] = "Registration";
    header("Location: ".$_SERVER['PHP_SELF']);
    exit;
   } else {

$datas = [':user'=>trim($user)];

$sql = "SELECT * FROM membersbase WHERE user = :user AND active = '1'";
$checkuser = [':user'=>trim($user)];
try{
  $sth = $connexion->prepare($sql);
  $sth->execute($checkuser);

Si dans localhost je tape sur page-de-depart.php, je passe immédiatement sur la page login.php