PHP script pre prihlasenie

//tam máme formulár na login
<form action='login.php' method='post'>
<input type='hidden' name='sent' /><br />
Meno: <input type='text' name='username' /><br />
Heslo: <input type='password' name='password' /><br />
<input type='submit' value='Prihlásiť sa' />
</form>

<?php
	session_start();
	if($_POST) {
		require_once 'db.php';
		$username = $_POST['username'];
		$password = $_POST['password'];
		$conn = mysql_connect($dbhost,$dbuser,$dbpass)
			or die ('Error connecting to mysql');
		mysql_select_db($dbname);
		$query = sprintf("SELECT COUNT(id) FROM users WHERE UPPER(username) = UPPER('%s') AND password='%s'",
			mysql_real_escape_string($username),
			mysql_real_escape_string(md5($password)));
		$result = mysql_query($query);
		list($count) = mysql_fetch_row($result);
		if($count == 1) {
			$_SESSION['authenticated'] = true;
			$_SESSION['username'] = $username;
			$query = sprintf("UPDATE users SET last_login = NOW() WHERE UPPER(username) = UPPER('%s') AND password = '%s'",
				mysql_real_escape_string($username),
				mysql_real_escape_string(md5($password)));
			mysql_query($query);
			$query = sprintf("SELECT is_admin FROM users WHERE UPPER(username) = UPPER('%s') AND password='%s'",
				mysql_real_escape_string($username),
				mysql_real_escape_string(md5($password)));
			$result = mysql_query($query);
			list($is_admin) = mysql_fetch_row($result);
			if($is_admin == 1) {
				$_SESSION['vstup'] = 'prihlaseny';	
				header('Location:admin/index.php');			
			} else {
				$_SESSION['vstup'] = 'prihlaseny';	
				header('Location:uzivatel/index.php');				
			}
		} else {	?>
<div class="text">Toto užívateľské meno a hoslo nezodpovedá databáze!</div>
<?php	}
	}
?>