login.php

<?php
include ('template.php');
if (isset($_POST['username']) and isset($_POST['password']))
{
	$query = <<<END
	SELECT username, password, id FROM users
	WHERE username = '{$_POST['username']}'
	AND password = '{$_POST['password']}'
END;
	$result =$mysqli->query($query);
	if ($result->num_rows > 0)
 {
		$row 					=		$result->fetch_object();
		$_SESSION["username"] 	=		$row->username;
		$_SESSION["userId"]		=		$row->id;
		header("Location:index.php");
 }	else{
		echo "wrong username or password, try again";
		}
}
$content = <<<END
	<form action="login.php" method="post">
		<input type="text" name="username" placeholder="username">
		<input type="password" name="password" placeholder="password">
		<input type="submit" value="Login">
	</form>
END;
echo $navigation;
echo $content;
?>