User/Admin Log-In form Php, MySQL

try this

<form method="post" action="">
<div id='userLogIn'>User LogIn</div>
Username <input type="text" name="username"> </br>
Password <input type="password" name="password"></br>
<input type="submit" name="submit" value="Log in">
</div>

<?php
include("dbconnect.php");
if(isset($_POST['submit']))
{
    $username = mysql_real_escape_string($_POST['username']);
    $user_pass = mysql_real_escape_string($_POST['password']);
    $sql = "SELECT * FROM info WHERE username='".$username."' and password='".$user_pass."'";
    $result=mysql_query($sql);
    $count = mysql_num_rows($result);
    if($count==1){
        $rows=mysql_fetch_array($result);
        if ($rows['admin_level']==1) {
            header ("Location:adminPage.php");
        }
        else{
            header ("Location:userPage.php");
        }
    }
    else{
        print "<font color=red>Username/Password Combination Error</font>";
    }
}

I highly recommend you read the history of this posts before continuing to go down by this path:

• How can I prevent SQL injection in PHP?
• A simple example of a Cross-site scripting attack

Your code is liable to be broken by using simple techniques of SQL Injection - since your variables are not sanitized or filtered.

Besides making your code work, you need to understand that there is no safe and secure to do so.

Once you are aware of the consequences that possession be from a leak information from your database to a full drop from your base.

This is what i do: First take the input from the form and establish variables.`

    $VerifyCredentials = AttemptSignIn($Username, $Password);
    if ($VerifyCredentials){
        //Success, store username in session
        //Mark user as signed in
        $_SESSION[Username] = $Username;
        RedirectTo("homepage.php");
        }else {
            //Failure
            $_SESSION["message"] = "Username/Password not found.";
            }
}
?>`

Here, there are some functions i made. The above function adds the username to the session for further page access (Which some pros would not recommend, for it has a slightly lesser security level), otherwise it sends a failure message.

Also always remember to use mysqli_real_escape_string() to protect against sql injection. Now i dont think you are encrypting the passwords, so i won't trouble you with that step.

Here is the attempt sign in function: I also have a table called users

global $connection; //I have a connection variable which establishes the connection.
//Test if connection was successful
if(mysqli_connect_errno()){
    die("Database connection failed: " . 
        mysqli_connect_error() . 
        " (" . mysqli_connect_errno() . ")"
        );
    }
    $SafeUsername = mysqli_real_escape_string($connection, $Username);
    $Query = "Select * ";
    $Query .= "From users ";
    $Query .= "Where username = '{$SafeUsername}' ";
    $Query .= "Limit 1";

$UserSet = mysqli_query($connection, $Query);
ConfirmQuery($UserSet);
if ($User = mysqli_fetch_assoc($UserSet)){
    return $User;
    }else {
        return null;
        }

}

function PasswordCheck($Password, $ExistingPassword) {
if ($Password === $ExistingPassword){
    return true;
    }else {
        return false;
        }
}

//First find the user
    $User = FindUsername($Username);
    if ($User){
    //User found, now compare the password
    if (PasswordCheck($Password, $User["password"])){
        //password matches
        return $User;
        }else //password does not match
        return false;
    }else {
        //User not found
        return false;
        }  
}