Untitled

<?php
session_start();

//edited by thinkfeed.info u better know it
//problem?

include "db_connect.php";
if(!$_POST['submit'])
{
?>
<html>
<b><Login</b>
<form method="post" action="index.php">
Username<input type="text" name="username" maxlength="16">
Password<input type="password" name="password" maxlength="16">
<input type="submit" name="submit" value="Login">
</form>
<a href="register.php">Register Here</a>
</html>

<?php
}
else
{
  $user = protect($_POST['username']);
  $pass = protect($_POST['password']);

if($user && $pass)
{
$pass = md5($pass); //compare the encrypted password
$sql="SELECT id,username FROM `users` WHERE `username`='$user' AND `password`='$pass'";
$query=mysql_query($sql) or die(mysql_error());

    if(mysql_num_rows($query) == 1)
 {
      $row = mysql_fetch_assoc($query); // mysql_fetch_assoc gets the value for each field in the row
      $_SESSION['id'] = $row['id']; //creates the first session var
      $_SESSION['username'] = $row['username']; // second session var;

    echo '<script type="text/javascript">window.location="home.php"</script>';
    }
    else
   {
    echo '<script type="text/javascript">';
    alert("Username and password combination is incorrect!");
    window.location="index.php".'</script>';
    }
}
else
{
    echo '<script type="text/javascript">';
    alert("You need to gimme a username AND password!!");
    window.location="index.php".'</script>';
}
}
?>