Login PHP

$username = $_POST[username];
$password = $_POST[password];
$sql="select * from personal where id='$username' and password='$password'";
$result=mysql_query($sql) or die(mysql_error());
$num=mysql_num_rows($result);

if($num == 0)
{
die("<script>
alert('รหัสประจำตัวหรือรหัสผ่านไม่ถูกต้อง');
history.back();
</script>");
}
$_SESSION['login'] = true;
$_SESSION['personal'] = mysql_fetch_assoc($result);
session_write_close();
redirect('index.php');
exit();