function admin_checker($username,$password)
{
    $username=remove_extra_in_string($username);
    $password=remove_extra_in_string($password);
    $q='select * from `admin` where `username`="'.$username.'" and `password`="'.$password.'"';
    $result=@mysqli_query($q);
    $_COOKIE['username'] = $result["username"];
    $_COOKIE['password'] = $result["password"];
    if(@mysqli_num_rows($result)==1)
        return 1;
    else
        return 0;
}

function remove_extra_in_string($string)
{
    $extra=array(''','"','`','/','*',';',' ','--');
    $string=str_replace($extra,'',$string);
    return $string;
}

if(admin_checker($_COOKIE['username'],$_COOKIE['password'])==1)
{ echo "ok"; } else { echo "not ok"; }