php determines whether to log in

<?php
session_start();
include "inc/conn.php";
$username=$_POST[user];
$password=$_POST[pwd];
 
$sql=mysql_query("select * from user where username=&#39;".$username."&#39; and password=&#39;".$password."&#39;");
if ($result = mysql_fetch_array($sql)){    $_SESSION[username]=$username; //其他页面通过判断是否设置$_SESSION[username]来判断登录状态
?>
 
<scriptlanguage="javascript">
alert("登录成功");window.location.href="file.php";
</script>
 
<?php
}else{
?>
 
<scriptlanguage="javascript">
alert("对不起，您输入的用户名或密码不正确，请重新输入!");window.location.href="index.php";
</script>
 
<?php
}
?>