使用PDO参数化查询仍然可以破解sql注入

我继承了一个老的基于php的网站，不断被黑客攻击。根据我在这里找到的信息:我如何在PHP中防止SQL注入?，我使用PDO参数化查询更新了sql查询。我们上周又被黑客攻击了，看起来像是sql注入攻击。所有用户名都从用户表中删除，并用自己的信息替换。然后黑客就能进入管理部分网站和制造各种各样的破坏。

在参数化查询中怎么会发生这种情况?

查看下面的代码-我错过了什么?我将更改用于此查询的数据库登录的权限，以便只允许选择，但我真的想知道为什么

class pdoConnection
{ 
    var $conn;
    function pdoConnection()
    {               
        $this->createConnection();
    }
        function createConnection()
    {
        try
        {
            $dbConnection = new PDO('mysql:host=mysqlhostname.com;dbname=mydbname;charset=utf8', 
                    'dbusername', 'dbpassword',
                    array(PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES utf8"));                   
            $dbConnection->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
            $dbConnection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
            $dbConnection -> exec('SET NAMES utf8');
            $dbConnection -> exec('SET CHARACTER SET utf8');
            $this->conn =$dbConnection;
        }
        catch(PDOException $e)
        {
            die('Could not connect: ' .$e->getMessage(). "<br><br>");
        }
    }
    //  GET CONNECTION
    //  --------------------------------------------------------------------- 
    function getConnection() 
    {   
        return $this->conn;
    } 
} 
$login = htmlspecialchars($_REQUEST['login'], ENT_QUOTES, 'UTF-8');
$pass =  htmlspecialchars($_REQUEST['pass'], ENT_QUOTES, 'UTF-8');
$msg = '';

//check to see if there is a value
if($login == '' || $pass == '') {
    $error = 1;
    $msg = "Please enter a username and password.<br />";
} 
else 
{
    //try to validate
    $clsPDO = new pdoConnection();
    $con = $clsPDO->getConnection();
    $stmt = $con->prepare('SELECT * FROM users where userName = :login');
    $stmt->execute(array(':login' => $login)) or die($con->errorInfo());
    $row = $stmt->fetch();
    if (isset($row))
    {
        if( $pass == $row['userPassword']) {
            $required_login = $row['userName'];
            $required_pass = $row['userPassword'];
            $userLevel = $row['userLevelID'];
            $userName = $row['userName'];
            $userID = $row['userID'];
        }
        else 
        {
            $error = 1;
            $msg = "Your username/password did not match. Please check your entries and try again.";
        }
    }
    else 
    {
        //did not validate
        $error = 1;
        $msg = "Your username/password did not match. Please check your entries and try again.";
    }
}