Авторизация php

<?php
session_start();
 
$bd = new mysqli('localhost', 'root', '', 'ie_test');
 
if(isset($_GET['exit'])){
    unset($_SESSION['name']);
}
 
if(isset($_POST['user']) && isset($_POST['password'])){
    $username = htmlspecialchars(trim($_POST['user']));
    $password = md5(htmlspecialchars(trim($_POST['password'])));
    $query = $bd->query("SELECT 'username', 'password' FROM 'users',  WHERE 'username'='$username' AND 'password'='$password'" );
    $result = $query->fetch_assoc();
    if($result){
        $_SESSION['name'] = $username;
    }else{
        echo '</br>Incorrect password';
    }
}
 
if(isset($_SESSION['name'])){
    echo 'Hello '.$_SESSION['name'];
    echo "</br><a href=\"?exit\">Exit</a>";
}
 
 
if(!isset($_SESSION['name'])){
    echo '<form method= "post" action="">
            <input type="text" name="user" placeholder="Name"/>
             <input type="password" name="password" placeholder="Password"/>
             <input type="submit" name="submit" value="Login"/>
             </form>
             <a href="reg.php">Reg</a>';
}
 
 
?>

$query = $bd->query("SELECT 'username', 'password' FROM 'users' WHERE 'username'='$username' AND 'password'='$password'" );

$query = $bd->query("SELECT `username`, `password` FROM `users`,  WHERE `username`='$username' AND `password`='$password'" );

if(isset($_POST['user']) && isset($_POST['password'])){
    $username = htmlspecialchars(trim($_POST['user']));
    $password = htmlspecialchars(trim($_POST['password']));
    include ('db.php');
    $query = mysqli_query($bd,"SELECT `username`, `password` FROM `users`  WHERE `username`='$username' AND `password`='$password'" );
    $result =  mysqli_num_rows($query);
    if($result){
        $_SESSION['name'] = $username;
    }else{
        echo 'Incorrect password';
    }
}