Untitled

<?php
  require_once('connectvars.php');

	if (isset($_POST['submit'])){
		  // Connect to the database
  $dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME) or die ("hiba");

    $nev = $_POST['username'];
    $jelszo = $_POST['password'];

    //mysql injction protection

	$nev = mysqli_real_escape_string($dbc, trim($nev));
	$jelszo = mysqli_real_escape_string($dbc, trim($jelszo));

  // Look up the username and password in the database
  $query = "SELECT user_id,username,password FROM mismatch_user WHERE username = '$nev' AND password = SHA('$jelszo')" or die("hiba".mysqli_error());
  $data = mysqli_query($dbc, $query);

  if (mysqli_num_rows($data) == 1) {
    // The log-in is OK so set the user ID and username variables
    $row = mysqli_fetch_array($data);
    $user_id = $row['user_id'];
    $username = $row['username'];
	  // Confirm the successful log-in
  echo('<p class="login">You are logged in as ' . $username . '.</p>');

  }
  else {
    // The username/password are incorrect so send the authentication headers
   echo "hiba";
  }

}

?>
<html>
<h2> Login </h2>
<form method="post" action="login.php" enctype="multipart/form-data">
<label>Username:</label>
<input type="text" name="username"><br>
<label>Password:</label>
<input type="password" name="password"> <br>
<input type="submit" value="Login" name="submit">
</form>
</html>