$db->query("SELECT * FROM user WHERE username = '$username' AND password= MD5(CONCAT(MD5('$password'), salt)) ");