<?php

    session_start();
    $link = new mysqli('localhost','root','','db_test');

    if(isset($_POST['login'])){
        if(!empty($_POST['username']) && !empty($_POST['password'])){
            $username = $_POST['username'];
            $password = $_POST['password'];
            #$username = mysqli_real_escape_string($link,$_POST['username']);
            #$password = mysqli_real_escape_string($link,$_POST['password']);
            $query = $link -> query("SELECT * FROM tbl_user WHERE user ='$username' AND password = '$password'");
            if($result = mysqli_num_rows($query) > 0){
                $_SESSION['user'] = $username;
                header("location:test.php");
            }else{
                echo "Wrong!!!";
            }

        }else{
            echo "Please!! Fill All";
        }
    }
?>

<form method="POST">
    <input type="text" name="username">
    <input type="password" name="password">
    <input type="submit" name="login">
</form>