login_fail

/* NOTES:   Errors have been commented in line with header location commands.
        Login.php uses $_GET['attn'] to load error message type and $_GET['u'] to reload username
        all $_GET values work when typed manually into address bar      */

    <?php
if (isset($_POST['verify'])){
    $username = $_POST['username'];
    $password = $_POST['password'];
    $remember = $_POST['remember'];
if ($username&&$password){
    $login = mysql_query("SELECT * FROM users WHERE username='$username'");
    while($row = mysql_fetch_assoc($login)) {
        $db_password = $row['password'];
        if (password($password) == $db_password) {
            $loginok = TRUE;
        } else {
            $loginok = FALSE;
        }
        if ($loginok==TRUE){
            if ($remember==TRUE) {
                setcookie("username",$username, time() + 7200);
            } else if ($remember==FALSE) {
                $_SESSION['username']=$username;
            }
            header('Location: index.php');  //blank white screen
            exit();
        } else {
            die(header('Location: login.php?attn=wl&u=',$username)); //no error or username
        }
    }

} else {
    die(header('Location: login.php?attn=no&u=',$username)); //no username
}
 }
?>