if (isset($_POST['login'])) {
    $username = anti_injection($_POST['username']);
    $password = anti_injection(md5($_POST['password']));

    // menghindari sql injection
    $injeksi_username = mysqli_real_escape_string($conn, $username);
    $injeksi_password = mysqli_real_escape_string($conn, $password);

    if (!ctype_alnum($injeksi_username) OR !ctype_alnum($injeksi_password)){
        header("Location:".base_url()."/404");
    }else{
        $query  = "SELECT * FROM users WHERE username='$username' AND password='$password'";
        $login  = $conn->query($query);
        $verify = $login->num_rows;
    $v      = $login->fetch_array();