login.php

<?php
session_start();

if(isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true){
    header("Location: index.php");
    exit;
}
 require_once "config.php";

$username = $password = "";
$username_err = $password_err = "";

if($_SERVER["REQUEST_METHOD"] == "POST"){

  if(empty(trim($_POST["username"]))){
      $username_err = "Please enter username.";
  } else{
      $username = trim($_POST["username"]);
  }

  if(empty(trim($_POST["password"]))){
      $password_err = "Please enter your password.";
  } else{
      $password = trim($_POST["password"]);
  }

  if(empty($username_err) && empty($password_err)){

    // Prepare the mysql query
    $stmt = $conn->prepare("SELECT id, username, password FROM users WHERE username = ?");

    // Execute the query with a cleansed version of $username
    $stmt->execute( [$username] );

    // Fetch the row as $user
    $user = $stmt->fetch();

    // If the row (user) exists in the database
    if($user) {

      // Verify the users password against the one in the database
      if( password_verify($password, $user['password']) ){

          // Store data in session variables
          $_SESSION["loggedin"] = true;
          $_SESSION["id"] = $user['id'];
          $_SESSION["username"] = $username;

          // Redirect user to home page
          header("Location: index.php");
      }else{
          // Display an error message if password is not valid
          $password_err = "The password you entered was not valid.";
      }
    } else{
        // Display an error message if username doesn't exist
        $username_err = "No account found with that username.";
    }
  }
}
?>