Code:

<?

include ("config.php");

    if (isset($HTTP_POST_VARS['username']) && isset($HTTP_POST_VARS['password'])) {
        $username = $HTTP_POST_VARS['username'];
        $usernamea = $username;
        $sifra = $HTTP_POST_VARS['password'];
        $passworda = $sifra;
        $passworda = md5($passworda);



        $name = str_replace("'","",$name);
        $name = str_replace("(","",$name);
        $name = str_replace(")","",$name);
        $name = str_replace("?","",$name);
        $name = str_replace("$","",$name);
        $name = str_replace('"',"",$name);
        $name = str_replace("%","",$name);
        $name = str_replace(" ","",$name);
        $sifra = str_replace("'","",$sifra);
        $sifra = str_replace("(","",$sifra);
        $sifra = str_replace(")","",$sifra);
        $sifra = str_replace("?","",$sifra);
        $sifra = str_replace("$","",$sifra);
        $sifra = str_replace('"',"",$sifra);
        $sifra = str_replace("%","",$sifra);
        $sifra = str_replace(" ","",$sifra);

        if($HTTP_POST_VARS['submit']){

        $query = mysql_query("SELECT * FROM user WHERE password='$passworda' AND name='$usernamea' LIMIT 1");
            if(mysql_num_rows($query)) {
                while($r=mysql_fetch_array($query)){
                    $id=$r['id'];
                    $password = $r['password'];
                    $name = $r['name'];
                    $status = $r['status'];
                    $loggin = "on";

                    $ehe = ":".$id.":".$passworda.":".$name.":".$status.":".$loggin.":";

                    setcookie("bobo", $ehe, time()+604800);

               }

                echo "<meta http-equiv=\"Refresh\" content=\"0; url=user.php?id=$id\">";
            }
            else
            {
               $error = 1;
               echo"<script language=JavaScript type=text/javascript>
                alert('Username/Password you entered are not correct. Please try again.');
                </script>";
            }
        }
    }
?>

<form action="<?$PHP_SELF?>" method="post">
Name:<br>
<input name="username" maxlength=16 style="height: 15px; width: 100px; font-family: arial; font-size: 9px; background: #ffffff url('http://s.sk-gaming.com/img/icon/login.gif') no-repeat 3px 5px; padding-left:14px; background-position-x:2px; background-position-y:1px; background-color:#ffffff" size="20"><br>
Password:<br>
<input name="password" maxlength=16 style="height: 15px; width: 100px; font-family: arial; font-size: 9px; background: #ffffff padding-left:14px; background-position-x:2px; background-position-y:1px; background-color:#ffffff" size="20"><br>
<input type="submit" name="submit" value="Submit">
</form>