Untitled

<?php

session_start();
require_once("includes/connect.php");

?>

<html>
<body>

<form action="" method="POST">

<h2> Login: </h2>

User Name: <input type="text" name="user" />
Password: <input type="password" name="pass" />
<input type="submit" name="login" />

</form>

<?php

if(isset($_POST['login']))
{
    $user = $_POST['user'];
    $pass = $_POST['pass'];
    $pass = md5($pass);

    if(mysql_num_rows(mysql_query("SELECT username, password FROM users WHERE username='$user' AND password='$pass'")))
    {
        $_SESSION['user'] = $user;
        header("Location:welcome.php");
    }

    else
    {
        echo "Invalid username and/or password";
    }
}

?>

</body>
</html>