I'm having a very annoying problem with a very simple PHP login script. The problem is that the login works even with wrong username and/or password. I'm running it in XAMPP 7.0.8 for Linux. By the way, the table "users" of the database "login" has only one row.

I've been trying to understand how these kind of scripts work, so I tried with the most basic kind of login I could. But it keeps being a mystery to me, by now I've never could make it work it out.

Here is the PHP part:

```
<?php

    session_start();

    if(isset($_POST['login'])) {

        $db = mysqli_connect("localhost", "root", "", "login");

        $username = strip_tags($_POST['username']);
        $password = strip_tags($_POST['password']);

        $username = stripcslashes($username);
        $password = stripcslashes($password);

        $username = mysqli_real_escape_string($username);
        $password = mysqli_real_escape_string($password);

        $sql = "SELECT * FROM users WHERE username = '$username' LIMIT 1";
        $query = mysqli_query($db, $sql);
        $row = mysqli_fetch_array($query);
        $id = $row['id'];
        $db_password = $row['password'];

        if($password == $db_password){
            $_SESSION['username'] = $username;
            $_SESSION['id'] = $id;
            header("Location: index.php");
        } else {
            echo "Error: the information is not correct.";
        }

    }
?>

```

And here the HTML form:

```
<!DOCTYPE html>
    <html lang="es">
    <head>
        <meta charset="UTF-8">
        <title>Client's area</title>
    </head>
    <body>
            <form method="post" action="">
                    <input type="text" name="username">
                    <input type="password" name="password">
                    <input class="login" type="submit" name="login" value="Login">
            </form>
    </body>
    </html> 

```

**Edit**: the idea of this post was never trying to make a secure login script, it was intended to understand some PHP features. I recognize it's not safe to use any part of this code for an actual login project.