Validating against back-end data - login

<?php
$users = ["coolBro123" => "password123!", "coderKid" => "pa55w0rd*", "dogWalker" => "ais1eofdog$"];

$feedback = "";
$message = "You're logged in!";
$validation_error = "* Incorrect username or password."; //General message not mentioning specifically whether is wrong username or password because if make known, hackers would know which they got right.
$username = "";


if ($_SERVER["REQUEST_METHOD"] === "POST"){
  $username = $_POST["username"];
  $password = $_POST["password"];
  if (isset($users[$username]) && $users[$username] === $password) {
    $feedback  = $message;   /* if want to reroute user to a different page upon successful login, add the code:
      header("Location: success.html"); //the word Location: must be there, followed by the url
      exit;
      */
  } else {
    $feedback = $validation_error;
  }
}
?>

<h3>Welcome back!</h3>
<form method="post" action="">
Username:<input type="text" name="username" value="<?php echo $username;?>">
<br>
Password:<input type="text" name="password" value=""> <!-- No value assigned to password input so as to make sure each login attempt is genuine. Also we cannot have the input filled with previous password to let any malicious attack to happen -->
<br>
<input type="submit" value="Log in">
</form>
<span class="feedback"><?= $feedback;?></span>