now most of logic works as it should

src/Database/Handler.php

@@ -60,11 +60,11 @@ class Handler
     }
     public function userExists(string $username): bool
     {
-        $statement = $this->pdo->prepare("SELECT * FROM users WHERE username = :username");
+        $statement = $this->pdo->prepare("SELECT 1 FROM users WHERE username = :username");
         $statement->execute([
-           $username
+           "username" => $username
         ]);
-        return $statement->rowCount() > 0;
+        return (bool) $statement->fetchColumn();
     }
     public function getPasswordHash(string $username): string
     {

src/Http/LoginController.php

@@ -27,7 +27,7 @@ class LoginController implements HttpServerInterface
             $responseHead = "400";
             $json = json_encode(["error" => "Not enough params"]);
         }
-        else if (!Handler::getInstance()->userExists($username) == !password_verify($password, Handler::getInstance()->getPasswordHash($username)))
+        else if (!Handler::getInstance()->userExists($username) || !password_verify($password, Handler::getInstance()->getPasswordHash($username)))
         {
             $login = false;
             $responseHead = "409";