Untitled

<!DOCTYPE html>
<html>
<head>
<title>Login</title>
</head>
<body>
<meta charset="utf-8">
<?php
include('template.php');
if (isset($_POST['username']) and isset($_POST['password'])) {
 $query = <<<END
SELECT username, password, id FROM users
 WHERE username = '{$_POST['username']}'
 AND password = '{$_POST['password']}'
END;
 $result = $conn->query($query);
 if ($result->rowCount() > 0) {
 $row = $result->fetchObject();
 $_SESSION["username"] = $row->username;
 $_SESSION["id"] = $row->id;
 header("Location:index.php");
 } else {
 echo "Wrong username or password. Try again";
 }
}
$content = <<<END
<form action="login.php" method="post">
<input type="text" name="username" placeholder="username">
<input type="password" name="password" placeholder="password">
<input type="submit" value="Login">
</form>
END;
echo $navigation;
echo $content;
?>
</body>
</html>