login

<?php
include ('template.php');
if (isset($_POST['username']) and isset($_POST['password'])){
    $query = <<<END
    SELECT username, password, id FROM user
    WHERE username = '{$_POST['username']}'
    AND password = '{$_POST['password']}'
END;
    $result =$mysqli->query($query);
    if ($result->num_rows > 0)
        {
        $row=$result->fetch_object();
        $_SESSION["username"]   =       $row->username;
        $_SESSION["userId"]     =       $row->id;
        header("Location:index.php");
        }
        if('admin' ==$_SESSION["userId"])
            header("Location:indexadmin.php")
        {
            $
        }
    else{
        echo "wrong username or password, try again";
        }
}
$content = <<<END
    <form action="login.php" method="post">
        <input type="text" name="username" placeholder="username">
        <input type="password" name="password" placeholder="password">
        <input type="submit" value="Login">
    </form>
END;
echo $navigation;
echo $content;
?>