login help

this is my script:
[code:1:e45362f94f]
<?

if (isset($_POST['login'])) {

$username = $_POST["user"];
$password = $_POST["pass"];

mysql_connect("localhost", "user", "pass") or die( "Unable to connect to database");
@mysql_select_db("db") or die( "Unable to select database");

$query="SELECT * FROM users WHERE user='$username' AND pass = '$password'";
$result=mysql_query($query);

$username = $row['username'];
$password = $row['password'];
$id = $row['id'];

if (mysql_num_rows==0) {
echo ("The database contains no record of your user or your password is incorrect.");
} else {
setcookie("XingName", "$username");
setcookie("XingID", "$id");
mysql_close();
echo("<meta http-equiv=\"refresh\" content=\"0;URL=./?p=\">");
echo("Hello there $user");

}} else {

echo("<form name=\"login\" action=\"\" method=\"post\">");
echo("<p>");
echo("<input name=\"user\" type=\"text\" id=\"user\">");
echo("</p>");
echo("<p>");
echo("<input name=\"pass\" type=\"password\" id=\"pass\" value=\"\">");
echo("</p>");
echo("<p>");
echo("<input type=\"submit\" name=\"login\" value=\"Submit\">");
echo("<input type=\"reset\" name=\"Reset\" value=\"Reset\">");
echo("</p>");
echo("</form>");

}

?>
[/code:1:e45362f94f]
it doesnt work though for some strange reason, anyone help?

your going $row['this']; but u need to run a while(){} loop ... :s