Just use $_POST to get it work

$login = $_POST["login"];
$pass = $_POST["pass"];

I am sure you must be knowing this. Now in PHP.ini you have some option i dont remeber something like register_globals and if thats on then you get all form variables directly into your form. THis is not safe and for production servers it should be always off.