$uname = $_POST['username'];
$pwd = md5($_POST['password']);
$sql = "SELECT * FROM `user` WHERE username = '$uname' AND password = '$pwd'";