I scanned my login script using SQL Inject Me Firefox addon
According to the Test Results, my script was vulnerable to SQL Injection. Result by example
"// some code" doesn't help much, but the problem may to be with this clean(). Try mysql_real_escape_string() instead.
Edit: As said above, 302 code means "you are being forwarded". It doens't mean the SQL Injection was sucessfull, as it doesn't mean it wasn't either. In this case you will only know that if you can determine where this 302 is forwarding you, to "admin.php" or "login.php".