Try echoing out the query you're running; you're confusing two kinds of string concatenation. But you shouldn't be concatenating
$login directly into your query in the first place - look at using a prepared statement and a placeholder instead.