login mysqli

<?php
require_once 'config.inc2.php';

$username = $_POST['username'];
$password = $_POST['password'];

if (strlen($username) > 0 && strlen($password) > 0) {

    $password = md5($password);

    $stmt = $mysqli->prepare('SELECT username, password FROM users WHERE username = ? and password = ?');
    $stmt->bind_param("ss", $val1, $val2);

    $val1 = $username;
    $val2 = md5($password);

    $stmt->execute();

    $stmt->bind_result($pizza);
    $stmt->fetch();
    var_dump($pizza);
    //var_dump($result);

    var_dump($stmt->rowCount());
            if ($stmt->rowCount() === 1) {
              session_start();

              $_SESSION['username'] = $username;
              header("location:home.php");
            } else {
              header("location:index.php");
              exit;
            }
} else {
  echo "Niet alle velden zijn ingevuld!";
  exit;
}
$stmt->close();
$pdo->close();
?>