$query = "SELECT * FROM `user` WHERE username='$username' and password='$password'";
$stmt = $connection->prepare('SELECT  * FROM user where username=? and password=?');
$stmt->bind_param('ss', $username,$password);
$stmt->execute();
$result = $stmt->get_result();
$count = $result->num_rows;