Untitled

<!DOCTYPE html>
<html lang="en">
<head>
  <title>Login</title>
</head>
<body>
  <form action="menu.php" method="POST">
  Username: <input type="text" name="user" id="user"><br>
  Password: <input type="text" name="passwd" id ="passwd"><br>
  <input type="submit">
  </form>

  <?php
    session_start();
    include_once "connection.php";
    $hash = "SELECT passwd FROM users WHERE username = \"$username\"";

    /* $sql = "SELECT * FROM users WHERE username=\"$username\" AND passwd=\"$pass_word\";
    if(mysqli_query($conn, $sql)){
        header('Location:session.php');
    } else{
        echo "Gebruikersnaam en/of wachtwoord niet correct.";
    } */


if (password_verify('passwd', $hash)) {
    // valid, proceed to login
    $_SESSION['user'] = $_POST['user'];
    header( "Location: session.php" );
} else {
    echo "Gebruikersnaam en/of wachtwoord onjuist.";
  }
  ?>
</body>
</html>