Untitled

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Login</title>
<link rel="stylesheet" href="css/style.css" />
</head>
<body>
<?php
require('db.php');
session_start();
if (isset($_POST['username'])){
    $username = stripslashes($_REQUEST['username']);
    $username = mysqli_real_escape_string($con,$username);
    $password = stripslashes($_REQUEST['password']);
    $password = mysqli_real_escape_string($con,$password);
        $query = "SELECT * FROM `users` WHERE username='$username' and password='".md5($password)."'";
    $result = mysqli_query($con,$query) or die(mysql_error());
    $rows = mysqli_num_rows($result);
    // REGARDE ICI TERRY !!!!!!!!!
    $rang = "SELECT * FROM `users` WHERE rang='1' and username='$username'";
    $rangQuery = $rang->fetch(PDO::FETCH_ASSOC);
    $_SESSION['rang'] = $rangQuery
    // FIN
        if($rows==1){
        $_SESSION['username'] = $username;
        header("Location: index.php");
         }else{
    echo "<div class='form'>
<h3>Pseudo/mdp incorrect.</h3>
<br/>Cliquez ici pour <a href='login.php'>réessayer</a></div>";
    }
    }else{
?>
<div class="form">
<h1>Log In</h1>
<form action="" method="post" name="login">
<input type="text" name="username" placeholder="Pseudo" required />
<input type="password" name="password" placeholder="Mot de passe" required />
<input name="submit" type="submit" value="Login" />
</form>
<p>Pas encore inscrit ? <a href='registration.php'>Inscrivez-vous !</a></p>
</div>
<?php } ?>
</body>
</html>