Untitled

<?php
include("header.php");
?>
<body>
<?php
$username = mysql_real_escape_string($_POST['username']);
$password = $_POST['password'];


if ($username&&$password)
{


$query = mysql_query("SELECT * FROM users WHERE username='$username'");

$numrows = mysql_num_rows($query);

if ($numrows!=0)
{
 while ($row = mysql_fetch_assoc($query))
 {
       $dbusername = $row['username'];
       $dbpassword = $row['password'];
 }

 // check to see if they match!
 if ($username==$dbusername&&$password==$dbpassword)
 {
    echo "Welcome back, $username";
    $user = ($_SESSION['user']);
    $_SESSION['user']=$username;
 }
 else
     echo "Incorrect password!";

}
else
    die("That User Doesn't exist!");


}
else
    die("Please enter a username and a password.");


?>

</body>