Dumb question: making a login box

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method=p.ost>

Username: <input type="text" name="username" maxlength="20" />
Password:<input type="password" name="password" maxlength="20" />
<input type="submit" name="submit" value="Login">

</form>

<?php

// Create a function for escaping the data.
	function escape_data ($data) {
		global $dbc; // Need the connection.
		if (ini_get('magic_quotes_gpc')) {
			$data = stripslashes($data);
		}
		return mysql_real_escape_string($data, $dbc);
} // End of function.

if (isset($_POST['submit'])) { // Check if the form has been submitted.

	require_once ('../mysql_connect.php'); // Connect to the database.
	
	if (empty($_POST['username'])) { // Validate the username.
		$u = FALSE;
		echo '<p><font color="red" >You forgot to enter your username!</font></p>';
	} else {
		$u = escape_data($_POST['username']);
	}
	
	if (empty($_POST['password'])) { // Validate the password.
		$p = FALSE;
		echo '<p><font color="red" >You forgot to enter your password!</font></p>';
	} else {
		$p = escape_data($_POST['password']);
	}
	
	if ($u && $p) { // If everything's OK.
	
		// Query the database.
		$query = "SELECT customer_id, firstname FROM customers WHERE username='$u' AND password=PASSWORD('$p')";		
		$result = @mysql_query ($query);
		$row = mysql_fetch_array ($result, MYSQL_NUM); 
		
		if ($row) { // A match was made.
				
				// Start the session, register the values & redirect.
				setcookie ('user_id', $row[0], time()+2419200, '/', '', 0);
				header ("Location:  http://www.domain.com/index.php");
				ob_end_flush(); // Delete the buffer.
				exit();
				
		} else { // No match was made.
			echo '<p><font color="red" >The username and password entered do not match those on file.</font></p>'; 
		}
		
		mysql_close(); // Close the database connection.
		
	} else { // If everything wasn't OK.
		echo '<p><font color="red" >Please try again.</font></p>';		
	}
	
} // End of SUBMIT conditional.

<?php
if (!isset($_COOKIE['user_id'])) {
	header ("Location:  http://www.domain.com/login.php");
	}
?>