Untitled

<?php

include("config.php");
session_start();
error_reporting(0);

$submit = $_POST['submit'];
$username = sanitize($_POST['username']);
$password = sanitize($_POST['password']);
$password = md5($password);

if($submit)
{
    if($username && $password)
    {
        $query = mysql_query("SELECT Name, Passwort FROM spieler WHERE Name = '$username' AND '".md5(strtoupper($password))."'");
        if(mysql_num_rows($query) == 1)
        {
            while($row = mysql_fetch_assoc($query))
            {
                $dbusername = $row['Name'];
                $dbpassword = $row['Passwort'];
            }
            if($username == $dbusername && $password == $dbpassword)
            {
                $_SESSION['username'] = $dbusername;
                echo header('location: profile.php');
            }
            else echo "Wrong password!";
        }
        else echo "Username doesn't exist!";
    }
    else echo "Type name and password!";
}

?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Basic UCP</title>

<form action='login.php' method='POST'>
<input type="text" name="username" value='<?php echo $username?>'/>
<input type="password" name="password"/>
<input type='submit' name="submit" value='Login' />
</form>
</head>
</html>