code snippet

// your code

if(count($_POST)>0 && $captcha == true) {
    $result = $mysqli->query("SELECT * FROM users WHERE username = '".$_POST["username"]."' AND password = '".sha1($_POST["password"])."'");

    if($result->num_rows){
        $row  = $result->fetch_assoc();
        if($row['active'] == '1'){
            $_SESSION["id"] = $row["id"];
            $_SESSION["username"] = $row["username"];
            $mysqli->query("DELETE FROM login_attempts WHERE ip = '$ip'");
        }else{
            echo "Your account is inactive";
        }
    }else{
        $message = "<div class='div-usuario-password-incorrecto'><br><span class='img-datos-incorrectos'><img src='img/error.png' width='40' height='40'></span>Login or password is invalid!</div>";
        if ($failed_login_attempt < 2) {
            $mysqli->query("INSERT INTO login_attempts (ip,date) VALUES ('$ip', NOW())");
        } else {
            $message = "<div class='div-failed-login'><br><span class='img-aviso-failed'><img src='img/aviso.png' width='40' height='40'></span>You have treated more than 3 invalid attempts. Enter the captcha code.</div>";
        }
    }
}