Formaulaire de login PHP + Session

<form action="login.php" method='post'>
<table align="center" border="0">
  <tr>
    <td>Login :</td>
    <td><input type="text" name="login" maxlength="250"></td>
  </tr>
  <tr>
    <td>Password</td>
    <td><input type="password"name="pass" maxlength="10"></td>
  </tr>
  <tr>
    <td colspan="2" align="center"><input type="submit" value="log in"></td>
  </tr>
</table>
</form> 

<?
$serveur = "localhost";
$nom_base = "utilisateur";
$login = "root"; 
$pwd =""; 

mysql_connect ($serveur,$login,$pwd) or die ("ERREUR " . mysql_error());
mysql_select_db ($nom_base) or die ("ERREUR " . mysql_error());

if(isset($_POST) && !empty($_POST['login']) && !empty($_POST['pass'])) 
{
  extract($_POST);
  $sql = "SELECT pwd FROM tbl_user where login=\"$login\";";
  echo $sql;
  $req = mysql_query($sql) or die("Erreur SQL !<br>" . $sql . "<br>" . mysql_error());

  $data = mysql_fetch_assoc($req);

  if($data['pwd'] != $pass) 
  {
    echo "<p>Mauvais login / password. Merci de recommencer</p>";
    include('login.html'); 
    exit;
  }
  else 
  {
    session_start();
    $_SESSION['login'] = $login;
    echo "Vous etes bien logué";
  }   
}
else 
{
  echo "<p>Vous avez oublié de remplir un champ.</p>";
   include('login.html'); // On inclut le formulaire d'identification
   exit;
}
?>