Are you sure you don't store passwords hashed?
Also, don't use this ugly function, use bound parameters. It's cleaner and better.
Update:
no
is returned whenever the following condition fails:
if (isset($_POST['username']) && isset($_POST['password']))
, no matter what's going on in MySQL
.
Check that you set both variables.