Untitled

<?php
require_once('functions.php');
dbConnect('localhost', 'root', '', 'website');
session_start();

if(isset($_POST['login'])){
    if(isset($_POST['username'], $_POST['password'])) {
        $username = mysql_real_escape_string($_POST['username']);
        $password = mysql_real_escape_string($_POST['password']);

        if(empty($username) || empty($password))
        {
            echo "Please complete all fields.";
        }

        if($username) {
            //Check wheather the given username and password match if it does then the log the user in
            //Otherwise tell the user the combination of username and password they provided was incorrect

            $sql = "SELECT `username` AND `password` FROM `users` WHERE `username` = '$username' AND `password` = '$password'";
            $res = mysql_query($sql) or die(mysql_error());
            $result = mysql_num_rows($res);

            if($result > 0 ) {
                //Log the user in and set the session variables
                $id = getIdFromUsername($username);
                $userData = getInfoFromId($id);
                echo $userData['id'];
            }else{
                //User provided incorrect information let the user know and ask them to try again.
                echo 'Wrong username and password combination';
            }
        }
    }
}

?>

<html>
    <head>
        <title>Login    </title>
    </head>
    <body>
        <div id="loginForm" align="center">
            <form method="post" action="<?php $_SERVER['PHP_SELF']; ?>">
                <p> Username: <input type="text" name="username" /> </p>
                <p> Password: <input type="password" name="password" /> </p>
                <input type="submit" name="login" value="Login" />
            </form>
       </div>
    </body>
</html>