Untitled

<?php
include ('config.php');
	if(isset($_POST['login'])) {

$username = $_POST['username'];
$password = $_POST['password'];
$blowfish = md5($password);


$sql = "SELECT * FROM members where username='$username' AND password='$blowfish' ";
$stmt = $dbconnect->prepare($sql);
$stmt->execute();
$session = $stmt->fetchAll(PDO::FETCH_ASSOC );
if($stmt->rowCount() == 1)
{
$_SESSION['user'] = $session[0]['username'];
header("location:index.php");
}
else
{
echo "Incorrect username or password.";
}
}
?>

<html>
<head>
<title></title>
</head>
<body>
<form method="POST" action="" >
<table border="0">

<tr><td>Username </td><td><input type="text" name="username" size="20" /></td></tr>

<tr><td>Password </td><td><input type="password" name="password" size="20" /></td></tr>

<tr><td></td><td><input type="submit" value="Login" name="login" /></td></tr>

</table>
</form>
</body>
</html>