if (isset($_POST['login'])) {
    include_once("db.php");
    $username = stripslashes($username);
    $password = stripslashes($password);
    $sql = "SELECT * FROM users WHERE username='$username' LIMIT 1";
    $query = mysql_query($sql);
    $row = mysql_fetch_array($query);
    $id = ['id'];
    $db_password = $row['password'];
    if ($password == $password) {
        $_SESSION['username'] = $username;
        $_SESSION['id'] = $id;
        header("Location: index.php");
    } else {
        echo "You have entered invalid credentials.";
    }
}