Untitled

<?php
error_reporting(E_ALL);
session_start();
include("database.php");
include("head.php");


if(isset($_POST['login'])) {
    $username = trim($_POST['username']);
    $password = trim($_POST['password']);
    $qry = mysql_query("SELECT * FROM user WHERE username = '$username' AND password = '$password'") or die (mysql_error());
    $numrow = mysql_num_rows($qry);
    echo $numrow;
    if($numrow > 0) {
        $_SESSION['username'] = $username;
        $_SESSION['password'] = $password;
        header('location:admin.php');
    } else {
        echo "can not loggedin to admin-panel";
header('location:login.php');
    }
}
?>
<html>
<head>
<title>Login Form</title>
</head>
<body>
<form method = "POST" action = "<?php echo $_SERVER['PHP_SELF']; ?>">
Username:<br />
<input type = "text" name = "username" value = ""><br />
Password:<br />
<input type = "password" name = "password" value = ""><br />
<input type = "submit" name = "login" value = "Login">
</form>

</body>
</html>
<?php
include("foot.php");

?>