<?php
    session_start();
    ob_start();

    // connect to database
    $db = mysqli_connect("localhost", "root", "", "authentication");
    if (isset($_POST['login_btn'])) {

      $_SESSION['message'] = "";
      $username = mysqli_real_escape_string($db,$_POST['username']);
      $username = $_POST['username'];
      $password = mysqli_real_escape_string($db,$_POST['password']);

      $password = md5($password); // remember we hashed password before storing  last time
      $sql = "SELECT * FROM users WHERE username ='$username' AND password='$password'";
      $result = mysqli_query($db, $sql);

      if (mysqli_num_rows($result) == 1) {

        $_SESSION['username'] = "You are now logged in";
        $_SESSION['password'] = $username;
        session_write_close();

        header("location:register.php"); //redirect to home page
        exit();
      }else{

        $_SESSION['message'] = "Username/password combination incorrect";
      }
    }
?>