title: php mysqli login form
body: <p>I have been attempting to create a login form. I have been playing around with the code below and still can not get a working login form.</p>
  
  <p>Is there any errors that is stopping my form from working? No matter what i type into the form it takes it to 'login.php' and then just presents a blank screen.  </p>
  
  <p>here is my HTML</p>
  
  <pre><code>&lt;?php
  include('login.php'); // Include Login Script
  if ((isset($_SESSION['username']) != '')) 
  {
  header('Location: home.php');
  }
  error_reporting(-1);
  ?&gt;
  &lt;form method="post" action="login.php"&gt;
  &lt;label&gt;Username:&lt;/label&gt;&lt;br&gt;
  &lt;input type="text" name="username" placeholder="username" /&gt;&lt;br&gt;&lt;br&gt;
  &lt;label&gt;Password:&lt;/label&gt;&lt;br&gt;
  &lt;input type="password" name="password" placeholder="password" /&gt;  &lt;br&gt;&lt;br&gt;
  &lt;input type="submit" value="Login" /&gt; 
  &lt;/form&gt;
  </code></pre>
  
  <p>Here is my login.php</p>
  
  <pre><code>&lt;?php
  session_start();
  include("connection.php"); //Establishing connection with our database
  
  $error = ""; //Variable for storing our errors.
  if(isset($_POST["submit"]))
  {
  if(empty($_POST["username"]) || empty($_POST["password"]))
  {
  $error = "Both fields are required.";
  }else
  {
  // Define $username and $password
  $username=$_POST['username'];
  $password=$_POST['password'];
  
  // To protect from MySQL injection
  $username = stripslashes($username);
  $password = stripslashes($password);
  $username = mysqli_real_escape_string($db, $username);
  $password = mysqli_real_escape_string($db, $password);
  $password = md5($password);
  
  //Check username and password from database
  $sql="SELECT id FROM staff WHERE username='$username' and password='$password'";
  $result=mysqli_query($db,$sql);
  $row=mysqli_fetch_array($result,MYSQLI_ASSOC);
  
  //If username and password exist in our database then create a session.
  //Otherwise echo error.
  
  if(mysqli_num_rows($result) == 1)
  {
  $_SESSION['username'] = $login_user; // Initializing Session
  header("location: home.php"); // Redirecting To Other Page
  }else
  {
  $error = "Incorrect username or password.";
  }
  
  }
  }
  
  ?&gt;
  </code></pre>
  
  <p>I have the database setup with the table called 'staff' with "id","username", "password"</p>