准备好的声明足够安全？

Question

I am trying to secure my login page with the prepared statement. The password is hashed, I tried also put it in the prepared statement, but it won't work.

I'm not sure that following code is secure enough.

<?php require 'Connections/localhost.php'; ?>

<?php
if(isset($_POST['LogIn'])) {

    session_start();

    $EM = $_POST['E-mail'];
    $PW = $_POST['Wacht-Woord'];

    $sql = "select Password, UserID, UserLevel from user where Email=?";

    $stmt = $con->prepare($sql);

    $stmt->bind_param("s", $EM);

    $stmt->execute();

    $stmt->bind_result($Password, $UID, $UL);

    while ($stmt->fetch())
    {
        if(password_verify($PW, $Password))
        {
            session_start();

            $_SESSION["UserID"] = $UID; 

            if($UL=="1")
            {
                header('Location: Account.php');
            }
            else if ($UL=="2")
            {
                header('Location: CRUD/indexAdmin.php');
            }
        }
        else
        {
            $_SESSION["LogInFail"] = "Yes";
        }
    }

}

?>