if(isset($_POST['login'])) {
    $username = mysql_real_escape_string(strip_tags($_POST['username']));
    $password = mysql_real_escape_string(strip_tags($_POST['password']));
    $enc_password = hash('sha512', $password);

    $q = "SELECT * FROM user WHERE username='".$username."' AND password='".$enc_password."'";
        $res = mysql_query($q) or die(mysql_error());

        if(mysql_num_rows($res) < 1 || empty($username) || empty($enc_password)) {
            header('Location: user.php?loginerror=');
            exit;
        }