nielsmh

$username = $_POST['username'];
$password = $_POST['password'];
$username = stripslashes($username);
$username = mysqli_real_escape_string($db, $username);
$sql = "SELECT * FROM users WHERE username='$username'";
$res = mysqli_query($db, $sql) or die(mysqli_error($db));
if (mysqli_num_rows($res) > 0)
{
  $row = mysqli_fetch_assoc($res);
  $hash = $row['password'];