[Volim te]

Why not have the DB connection code in it's own file? Saves on space (:

[Volim te]

If we are being picky, the username is vulnerable to xss injection, try inputting a username like

<script>alert("xss");</script>

U can filter either the input or output by using strip_tags and htmlentities. Of course this isn't full-proof, but it will stop the majority of attacks.

EDIT:: Didn't even notice that you are, huh...

ignore this then lol

1 use htmlspecialchars() not htmlentities()
2: remove unwanted chars rather than use the vulnerable strip_tags()
>"<script>alert(1)<script><" should bypass strip_tags()...

Sample: Only allow letters, numbers and underscores.

if (!preg_match('/^[a-z0-9_]*$/UD',$_POST[username])){
# We're not ok, do not allow this username !
}

[u fux wid it]

Does this save the file as a batman file or a superman file?

[Volim te]

Thanks for the feed back guys. So overall its quite secure?

It's good but you should add LIMIT 1 to the query checking if the user exist and for logging in.