Untitled

<?php
    $con = mysql_connect("localhost","root","wow");
    if (!$con)
    {
        die('Could not connect: ' . mysql_error());
    }

    mysql_select_db("inventory", $con) or die (mysql_error ());

    if(isset($_GET['action']))
    {
        switch($_GET['action'])
        {
        case 'checklogin':
        // username and password sent from form
        $loginusername=$_POST['account'];
        $loginpassword=$_POST['password'];

        // To protect MySQL injection (more detail about MySQL injection)
        $loginusername = stripslashes($loginusername);
        $loginpassword = stripslashes($loginpassword);
        $loginusername = mysql_real_escape_string($loginusername);
        $loginpassword = mysql_real_escape_string($loginpassword);

        $sql="SELECT * FROM accounts WHERE account='$loginusername' and password='$loginpassword'";
        $result=mysql_query($sql);

        // Mysql_num_row is counting table row
        $count=mysql_num_rows($result);

        if($count==1){
        session_register("loginusername");
        session_register("loginpassword");
        header("location:main.php");
        }
        else {
        echo 'Wrong Username and or Password<br><br><br><br><br>Click <a href="login.php">here</a> to go back to the login page.';
        }

        break;
        }
    }
    else
    {
        echo "<html>
        <body>

        <form action="?action=checklogin" method="post">
        Account:      <input type="text" name="account" /><br><br>
        Password:   <input type="password" name="password" /><br><br>
        <input type="submit" value="Login" />
        </form>

        </body>
        </html>";
    }