Like every other variable coming from a form, check that [font=monospace]$POST['username'][/font] (and [font=monospace]$POST['password'][/font]) actually exist before trying to use them. (And have some idea of what you want to do if they don't.)
Also, read the warnings at the top of the [man]mysql_connect[/man], [man]mysql_select_db[/man], [man]mysql_real_escape_string[/man], [man]mysql_query[/man], and [man]mysql_num_rows[/man] pages.