Удаление статьи с помощью токена

Работает, правильно ли сделал удаление статьи, с помощью токена?

Авторизация

if(!empty($_POST['auth'])) {
            if(!empty($_POST['login']) && !empty($_POST['password'])) {
                $login = $_POST['login'];
                $secret = 'hhJNE63';
                $password = md5($_POST['password'].$secret);
                $user = "SELECT `id`, `login`, `password` FROM users WHERE login = :login AND password = :password";
                $resUser = $pdo->prepare($user);
                $resUser->bindValue(':login', trim($login), PDO::PARAM_STR);
                $resUser->bindValue(':password', trim($password), PDO::PARAM_STR);
                $resUser->execute();
                $resUser2 = $resUser->fetchAll();
                $userId = $resUser2[0]['id'];
                if(count($resUser2) === 0){
                    die('Неверный логин или пароль');
                }
                else {
                    $arr = ['f', 3, 'g', 'bd', 5, 'p', 'k', 'n', 'v', 'w', 33, 'c', 'o'];
                    shuffle($arr);
                    $str = '';
                    foreach($arr as $k) {
                        $str .= $k;
                    }
                    $sql = "UPDATE users SET randomSTR ='" . $str . "' WHERE login = '" . $login . "'";
                    $queryToket = $pdo->query($sql);
                    setcookie ("user", $str, time()+3600);

                    $salt = $login;
                    $tokenstr = strval(date('s')) . $salt;
                    $token = md5($tokenstr);
                    $_SESSION['token'] = $token;
                    $_SESSION['user'] = $login;
                    $_SESSION['id'] = $userId;
                    output_add_rewrite_var('token', $token);
                    header('Location: ./index.php');
                }
            }
            else {
                echo '<p class="mudak">Заполните все поля</p>';
            }
        }

Удаление

<?php
echo '<p>Добавить статью</p>';
require_once 'add.php';
echo '<p>Мои статьи</p>';
$myArticle = "SELECT article.id, title, user_id FROM article INNER JOIN users ON article.user_id = " . $_SESSION['id'] . " GROUP BY article.title";
$sth = $pdo->query($myArticle);
$sth->setFetchMode(PDO::FETCH_ASSOC);
$userArticle = $sth->fetchAll();
echo '<pre>';
print_r($userArticle);
echo '</pre>';

echo '<table>';
echo '<tr>';
    echo '<td>Название</td>';
    echo '<td>Действие</td>';
echo '</tr>';
foreach($userArticle as $key) {
    echo '<tr>';
    echo '<td>'.$key['title'].'</td>';
    echo '<td><form method="post">
        <input type="hidden" name="id-title" value="'.$key['id'].'">
        <input type="hidden" name="id-user" value="'.$key['user_id'].'">
        <input type="submit" name="del-article" value="Удалить">
    </form></td>';
    echo '</tr>';
}
echo '<table>';
if(!empty($_POST['del-article'])) {
    $sql = "SELECT article.id, `title`, `user_id`, users.randomSTR FROM article INNER JOIN users ON article.id = '".$_POST['id-title']."' AND article.user_id = '".$_POST['id-user']."' AND users.randomSTR = '".$_COOKIE['user']."' GROUP BY article.title";
    $sth = $pdo->query($sql);
    $sth->setFetchMode(PDO::FETCH_ASSOC);
    $delArticle = $sth->fetchAll();
    if(count($delArticle[0]) > 1) {
        $sqlDelArticle = "DELETE FROM article WHERE id = :id";
        $del = $pdo->prepare($sqlDelArticle);
        $del->bindValue(':id', $_POST['id-title'], PDO::PARAM_INT);
        $del->execute();
        echo 'Удалено';
    }
    else {
        echo 'Ошибка удаления';
    }
}