You probably need to check both the username and password. (Don't forget to check the user's input for expected valid charactures.)

my $valid_user = $dbh->selectrow_array("SELECT COUNT(*) FROM usertable
+ WHERE username='$username' AND password=PASSWORD($password)");

or using placeholders

my $sth = $dbh->prepare("SELECT COUNT(*) FROM usertable WHERE username
+=? AND password=PASSWORD(?)");
$sth->execute($username,$password);
my ($valid_user) = $sth->fetchrow_array();
[download]