Mini Shell

<?php
    include 'db/database.php';
    
    $username = mysqli_real_escape_string($link,$_POST['username']);
    $password = mysqli_real_escape_string($link,$_POST['password']);
    
    
    
    $salt = 'tikde78uj4ujuhlaoikiksakei896';
    $hash_login_password = hash_hmac('sha256', $password, $salt);
   
    $sql = "SELECT * FROM user WHERE  username='".$username."' and password='".$hash_login_password."' ";
    $result = mysqli_query($link, $sql);
    
   if(mysqli_num_rows($result)=== 1){
        session_start();
        $row_user = mysqli_fetch_array($result, MYSQLI_ASSOC);
        $_SESSION['user_id'] = $row_user['user_id'];      
        $_SESSION['username'] = $row_user['username'];
        header('Content-Type: application/json');
        echo json_encode(array('status' => 'success'));
    } else {
        header('Content-Type: application/json');
        $errors = "Username หรือ Password ไม่ถูกต้อง" . mysqli_error($link);
        echo json_encode(array('status' => 'danger','message' => $errors));
    }
    
  mysqli_close($link);