login dengan session

<?php
session_start();
#**************** koneksi ke mysql *****************#
$host = "localhost";
$user = "root";
$pass = "";
$dbname = "belajar";
$conn = mysql_connect($host,$user,$pass)or die(mysql_error());
/*percuma kl gk bisa connect.. */
    $sele = mysql_select_db($belajar);

#***************** akhir koneksi ******************#

#jika ditekan tombol login
if(isset($_POST['login']))
{
    $username = $_POST['username'];
    $password = $_POST['password'];
    $sql="SELECT * FROM user WHERE username='$username' &&
    password='$password'";
    $q = mysql_query($sql)
        or die(mysql_error()."<br>sql=$sql");
    $num = mysql_num_rows($sql);

    if($num==1) {
        // login benar //
        $_SESSION['user'] = $username;
        $_SESSION['passwd'] = $password;
        echo "<script language=\"JavaScript\">alert('Anda berhasil login');
        document.location='berhasil.php'</script>";
    }
    else
    {
    // jika login salah //
        echo "<script language=\"JavaScript\">alert('Username atau password Anda
        salah'); document.location='login.php'</script>";

    }

}
?>