Dump that script. It uses session_register which is deprecated, and relies on other outdated php features like register globals being on. Basically this script is 2 or 3 years out of date.
It does not query the db because, I'm sure, your server has globals OFF and so the post vars are not instantly available and must be accessed through $_POST['username'] etc. , so your query has empty parameters and returns nothing.
To set the session vars you should use $SESSION['username'] = $POST['username'] or similar construction.
I suggest that you have a look at Kevin Yanks solution on Sitepoint . The access control script works very well - I use a modified version myself as I wanted account lockout etc. so I extended it; but the core code is still his and it works wonderfully.
