Hydra bruteforce index lab

<?php
$message = "";
$message_class = "";

// Credenciales correctas de prueba
$correct_user = "admin";
$correct_pass = "secret123";

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = $_POST['username'] ?? '';
    $password = $_POST['password'] ?? '';

    if ($username === $correct_user && $password === $correct_pass) {
        $message = "login: [" . htmlspecialchars($username) . "] password: [" . htmlspecialchars($password) . "] found";
        $message_class = "success";
    } else {
        $message = "Invalid username or password";
        $message_class = "error";
    }
}
?>
<!DOCTYPE html>
<html lang="es">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Login Test Portal</title>
    <link rel="stylesheet" href="style.css">
</head>
<body>
    <div class="login-container">
        <h2>Sistema de Autenticación</h2>
        <form method="POST" action="">
            <div class="input-group">
                <label for="username">Usuario:</label>
                <input type="text" id="username" name="username" required autocomplete="off">
            </div>
            <div class="input-group">
                <label for="password">Contraseña:</label>
                <input type="password" id="password" name="password" required>
            </div>
            <button type="submit">Iniciar Sesión</button>
        </form>

        <?php if (!empty($message)): ?>
            <div class="result-message <?php echo $message_class; ?>">
                <?php echo $message; ?>
            </div>
        <?php endif; ?>
    </div>
</body>
</html>