Untitled

<?php
session_start();
if(isset($_SESSION['username']))
{
    header("Location: index.php");
}

if(isset($_POST['login']))
{
        $mysql_host = 'localhost';
        $mysql_usr = 'user';
        $mysql_pw = 'pw';
        $mysql_db = 'db';
        $con = mysql_connect($mysql_host, $mysql_usr, $mysql_pw);
        mysql_select_db($mysql_db, $con);
        $username = mysql_real_escape_string($_POST['username']);
        $pass = hash('whirpool', $_POST['password']);
        $password = mysql_real_escape_string($pass);
        $login = mysql_query("SELECT * FROM tablename WHERE username = '$username' AND password = '$password'", $con);
        if(mysql_num_rows($login) == 1)
        {
                $_SESSION['username'] = $username;
                header("Location: index.php");
        }
        else echo "Wrong username and/or password!";
}
else
{
?>
<html>
<head>
</head>
<body>
<center>
<form action="" method="POST" >
Username: <input type="text" name="username" /><br />
Password: <input type="password" name="password" /><br />
<input type="submit" name="login" value=" Login! " />
</form>
</center>
</body>
</html>
<?php
}
?>