<?php
session_start();
$username = $_POST["txtUsername"];
$password = $_POST["txtPassword"];
$sql = "select count(*) from users where username=? and password=?";

$db = new mysqli("127.0.0.1", "root", "student", "todo");

$stmt = $db->prepare($sql);

//add parameters to sql
$stmt->bind_param("ss", $username, md5($password));

$stmt->execute();

$stmt->bind_result($userCount);
$stmt->fetch();

if($userCount > 0) {
    $_SESSION["USERNAME"] = $username;
    header("Location:tasks.html");
} else {
    header("Location:login.html");
}
//DB <- mysqli ->prepare ->mysqli_stmt -> execute(sql) ->fetch()
?>