$sql = "SELECT * FROM users WHERE username=? AND password = ?";
$stmt = mysqli_stmt_init($db);
if (!mysqli_stmt_prepare($stmt, $sql)) {
  header("Location: ../login.php?error=sqlerror");
  exit();
}
else {
  mysqli_stmt_bind_param($stmt, "ss", $username, $password);
  mysqli_stmt_execute($stmt);
  $result = mysqli_stmt_get_result($stmt);
  if ($row = mysqli_fetch_assoc($result)) {

      session_start();
      $_SESSION['userId'] = $row['idUsers'];
      $_SESSION['userMail'] = $row['emailUsers'];

      header("Location: ../index.php?login=success");
      exit();
    }