login

<?php
include ('template.php');
if (isset($_POST['username']) and isset($_POST['password']))
{
$query = <<<END
    SELECT username, password, id FROM user
    WHERE username = '{$_POST['username']}'
    AND password = '{$_POST['password']}'
END;
$result =$mysqli->query($query);
if ($result->num_rows > 0)
 {
        $row=$result->fetch_object();
        $_SESSION["username"]   =$row->username;
        $_SESSION["userId"]     =$row->id;
        header("Location:index.php");
 }
    else
        {
        echo "wrong username or password, try again";
        }
}
$content = <<<END
    <form action="login.php" method="post">
        <input type="text" name="username" placeholder="username">
        <input type="password" name="password" placeholder="password">
        <input type="submit" value="Login">
    </form>
END;
echo $navigation;
echo $content;
?>