Untitled

<?php
session_start();
$mysqli = new mysqli('localhost', 'root', '', 'mybd');

if (mysqli_connect_errno()) {
 printf("Conexión fallida: %sn", mysqli_connect_error());
 exit();
}
if (isset($_GET['login'])) {
 if ($_GET['login'] == "true") {
  $query = "SELECT user,pass FROM usuarios WHERE user =";
  $query.= "'".$_GET['user']."'";
  $query.= " AND pass =";
  $query.= "'".$_GET['pass']."'";
  $res = $mysqli->query($query);
  if ($row = mysqli_fetch_array($res)) {
    if ($row['user'] == $_GET['user'] && $row['pass'] == $_GET['pass']) {
      $_SESSION['login'] = $_GET['user'];
      header("Location: http://".$_SERVER['HTTP_HOST']."/panel/panel.php");
    }else{
      session_unset();
      echo json_encode(array("text"=>"Datos erroneos, intentelo de nuevo."));
   }
 }
}else{
  session_unset();
  unset($_SESSION['login']);
  header("Location: http://".$_SERVER['HTTP_HOST']."/panel/");
 }
}
?>

function id(id){
  return document.getElementById(id);
}
function clase(clase){
  return document.getElementsByClassName(clase);
}
var form = id("loginform");
form.addEventListener('submit',function(e){
  e.preventDefault();
  e.stopPropagation();
  var user = id("user").value;
  var pass = id("pass").value;
  var url = location.protocol+"//"+location.host+"/panel/login.php?login=true&user="+user+"&pass="+pass;
  xhr = new XMLHttpRequest();
  xhr.open('GET', url, true);
  xhr.onreadystatechange = function(response){
  if (xhr.readyState == 4 && xhr.status == 200) {
      if (response) {
        var data = JSON.parse(JSON.stringify(response.target.responseText));
        console.log(data);
        if (data.text) {
          id("resp").innerText = data.text;
        }
      }
  }
 };
 xhr.send();
 });

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta http-equiv="X-UA-Compatible" content="ie=edge">
    <title>Document</title>
</head>
<body>

</body>
</html>