Permessi login php

[traco]

non funziona.non so se la logica è giusta. vi posto le due funzioni.

        public function VerifyLogin()
        {
            $username = $_POST['username'];
            $password = md5($_POST['password']);
            $this->DbConnect();
            //$sql = "SELECT id FROM utenti WHERE username='$username' AND password='$password' AND ver=1";
            $sql = "SELECT id,auth_level FROM utenti WHERE username='$username' AND password='$password' AND ver=1";
            $res = mysql_query($sql,$this->conn);
 
 
 if($row = mysql_fetch_array($res))
{
    $_SESSION['auth'] = $row['auth_level']; //prendo l'id del permesso
    $_SESSION['user_id'] = $row['id'];
    $sql1 = "SELECT username FROM utenti WHERE id=$_SESSION[user_id]";
            $res1 = mysql_query($sql1,$this->conn);
            $row1 = mysql_fetch_array($res1);
           $_SESSION['u'] = $row1['username'];
    header("Location: ww.php");
    mysql_close($this->conn);
    die;
}
            else
            {
                header("Location: login.php?alert=1");
                mysql_close($this->conn);
                die;
            }
        } 

        public function IsAdmin()
{


   if($_SESSION['auth'] == 2)
    {
        header("Location :database.php");
    }
    else
    {
        header("Location :index.php");
    }
} 

       <?php 
include 'authentication.class.php';
 
$auth = new UserAuthentication();
$auth->IsAuth();
$auth->IsAdmin();
 
 

?>