Try this in your submitlogin.php page
$query = "SELECT * FROM users where username = '$username' AND password = '$password'";
$result = mysql_query($query,$db);
$total = mysql_num_rows($result);
if(!$total)
{
header("Location:message.php?3"); //this redirects to a page which displays "Wrong Username or password"
}
else
{
header("Location:users.php?username=$username");
}