Untitled

<html>
    <body>
    <center>
    <FORM action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
    User Name: <input type="text" name="user" maxlength="8"><br>
    Password: <input type="password" name="pass" maxlength="12"><br>
    <input type="submit" name="submit" value="Register">
    </form>
    </body>
<?php
//require db to connect.
require_once('connect.php');

//protect from sql injection
$user = $_POST['user'];
$pass = $_POST['pass'];


//select the table
$result = mysql_query("SELECT * FROM users WHERE $user = 'username' AND $pass = 'password'");

//count the rows. register the session, give the error/correct messages. and redirect.
if (mysql_num_rows($result) != 1)
    echo "Please go back and try again.";
else {
    session_register("$user");
    session_register("$pass");
    header('location: index.php');
?>