At a quick look:

• Your code is vulnerable to SQL Injection: assume the user wants to hurt you, so always parse superglobals $_GET and $_POST

  http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

• To check if variable have values:

    // good practice
    if (isset($userName, $userPass))
    // bad practice
    if ($userName && $userPass )
  

• More important:

Don't reinvent the wheel unless you plan on learning more about wheels.

A simple search on google for PHP login system will give you a limitless number of examples from where you can learn how to build a proper system:

http://www.phpeasystep.com/workshopview.php?id=6

At a quick look:

• Your code is vulnerable to SQL Injection: assume the user wants to hurt you, so always parse superglobals $_GET and $_POST

  https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

• To check if variable have values:

    // good practice
    if (isset($userName, $userPass))
    // bad practice
    if ($userName && $userPass )
  

• More important:

Don't reinvent the wheel unless you plan on learning more about wheels.

A simple search on google for PHP login system will give you a limitless number of examples from where you can learn how to build a proper system:

http://www.phpeasystep.com/workshopview.php?id=6

At a quick look:

• Your code is vulnerable to SQL Injection: assume the user wants to hurt you, so always parse superglobals $_GET and $_POST

  http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

• To check if variable have values:

    // good practice
    if (isset($userName, $userPass))
    // bad practice
    if ($userName && $userPass )
  

• Split the connection phase and call die if you cannot connect.

    // bad practice
    $con = mysqli_connect($IP, $user, $pass, $db);
    // good practice
    mysql_connect("$host", "$username", "$password")or die("cannot connect");
    mysql_select_db("$db_name")or die("cannot select DB");
  

• More important:

Don't reinvent the wheel unless you plan on learning more about wheels.

A simple search on google for PHP login system will give you a limitless number of examples from where you can learn how to build a proper system:

http://www.phpeasystep.com/workshopview.php?id=6

At a quick look:

• Your code is vulnerable to SQL Injection: assume the user wants to hurt you, so always parse superglobals $_GET and $_POST

  http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

• To check if variable have values:

    // good practice
    if (isset($userName, $userPass))
    // bad practice
    if ($userName && $userPass )
  

• More important:

Don't reinvent the wheel unless you plan on learning more about wheels.

A simple search on google for PHP login system will give you a limitless number of examples from where you can learn how to build a proper system:

http://www.phpeasystep.com/workshopview.php?id=6