Secure login PHP and JS

<?php
if (isset($_POST['username']) && isset($_POST['password']) && isset($_POST['js'])) {

    include('init.php');
    mysql_connect(DB_HOST, DB_USER, DB_PASS);

    $user = mysql_real_escape_string($_POST['username']);
    $pass = mysql_real_escape_string($_POST['password']);

    if($_POST['js'] == 'off')
        $pass = md5($pass);

    $res = mysql_query("SELECT * FROM users WHERE user='$user' AND pass='$pass';");

    if(mysql_num_rows($res) == 1) {
        session_start();
        $_SESSION['user'] = mysql_fetch_array($res);
    }

}
?>

<form method="get" action="" onsubmit="this.password.value=md5(this.password.value); this.js.value='on';">
    <input type="text" name="username" value="<?php echo (isset($_POST['username']) ? $_POST['username'] : '') ?>">
    <input type="password" name="password" autofocus="">
    <input type="hidden" name="js" value="off">
    <input type="submit" value="Login">
</form>