Mini Shell

<?php
    include '../../db/database.php';
    
     $username = $_POST['username'];
     $year = $_POST['year'];
   
    $sql = "SELECT * FROM users_dg WHERE username = '".$username."' and year='".$year."' ";
    $result = mysqli_query($link2, $sql);
    
   if(mysqli_num_rows($result)=== 1){
        session_start();
        $row_user = mysqli_fetch_array($result, MYSQLI_ASSOC);
        $_SESSION['user_id'] = $row_user['user_id'];      
        $_SESSION['username'] = $row_user['username'];
        header('Content-Type: application/json');
        echo json_encode(array('status' => 'success'));
    } else {
        header('Content-Type: application/json');
        $errors = "รหัสนักเรียนไม่ถูกต้อง!" . mysqli_error($link);
        echo json_encode(array('status' => 'danger','message' => $errors));
    }
    
  mysqli_close($link);