PHP & MySQLi Login Script - Is it safe from Injection?
There's no need for the $user variable (it's already in $myusername) so don't query for it either.

Please, deal with the $previous = $_SERVER['HTTP_REFERER']; now. You don't want to allow a malicious user to edit the HTTP headers you send.

What do you plan to do if any of the database calls fail? You don't seem to be checking for nor handling that. Also, it's best to have the exact same behavior on "invalid username" as well as "password supplied does not match". I'm not sure if your code does that or not.

I didn't think people usually put spaces around the -&gt; method call operator, but at least be consistent with your spacing.