Untitled

<?php
    session_start();
    require 'mysql.php';
    if ( isset($_POST['login']) && $_POST['username']!=' ' )
    {
        $usr = $_POST['username'];
        $query = "SELECT * FROM users WHERE username='$usr'";
        $result = mysql_query($query) or
            die(mysql_error());
        if ( $row = mysql_fetch_array($result) )
        {
            if ( $row['password'] == md5("asdf".md5($_POST['password'])) )
            {
                $_SESSION['username']=$usr;
                $_SESSION['auth']=true;
                echo 'Redirecting to main page';
            }
            else
                echo 'Password does not match!';
        }
        else
            echo 'User does not exist! <a href="newaccount.php">Create new account</a>';
    }
?>
<html>
<head>
<title>Login</title>
</head>
<body>
<?php
    if ( !isset($_SESSION['auth']) || $_SESSION['auth']=false )
    {
        echo '<form action="login.php" method="POST">';
        echo 'Username: <input type="text" name="username" /><br />';
        echo 'Password: <input type="password" name="password" /><br />';
        echo '<input type="submit" name="login" value="Log in"></form>';
    }
?>
</body>
</html>