<form method="post" action="login.php">
Username<br><input type="text" name="username"><br>
Password<br><input type="password" name="password"><br><br>
<input type="submit" name="login" value="Login">
</form>

<?php
include("config.php");
    if (@$_POST["login"] != "")
    {
        $username = $_POST["username"];
        $password = $_POST["password"];

          $query = "SELECT user , password FROM tabella WHERE user = '$username'";
  $result = mysql_query($query, $connessione);
  while ($row = mysql_fetch_array($result))
{
$usernameg = $row['autore'];
$passwordg = $row['titolo'];
}

        if ($username == "$usernameg" && $password == "$passwordg")
        {
            setcookie("login", "OK");
                    header("location: paginadaproteggere.php");
        }
        else
        {
            echo "Accesso negato!";
        }
    }
?>