php logon error - Parse error: syntax error, unexpected T_IF

Question

I'm getting the error on line 23 which is this line:

if (mysql_num_rows($result) > 0) { 

Can you see my code below and see anything I've missed?

<?php
// Include database connection and select database UFPProducts
     include "../shopdb/connection.php";
?>
<?php
//
session_start();
// (2) Collect data from form and save in variables

$username=$_POST['username'];
$password=$_POST['password']; 

// (3) Create query of the form below to search the user table
//   "SELECT * FROM Users WHERE UserName='$username' AND  Password='$password'"

"SELECT * FROM USERS where Username='$username' AND Password='$password'"

// (3) Run query through connection

// (4) Check result of query using code below

// if rows found set authenticated user to the user name entered 
if (mysql_num_rows($result) > 0) { 
$_SESSION["authenticatedUser"] = $username;
// Relocate to the logged-in page
header("Location: loggedon.php");
} 
else
// login failed redirect back to login page with error message
{
$_SESSION["message"] = "Could not connect as $username " ;
header("Location: login.php");
}
?>

Thank you for your time & help

Answer 1

Use this code, this way you will minimize your chances of getting your site hacked through SQL injection.

<?php
// Include database connection and select database UFPProducts
     include "../shopdb/connection.php";
?>
<?php
//
session_start();
// (2) Collect data from form and save in variables

$username=mysql_real_escape_string(htmlentities($_POST['username']));
$password=mysql_real_escape_string(htmlentities($_POST['password']));

// (3) Create query of the form below to search the user table
//   "SELECT * FROM Users WHERE UserName='$username' AND  Password='$password'"

$query = "SELECT * FROM USERS where Username='$username' AND Password='$password'";
$result = mysql_query($query) or die (mysql_error()); 

// (3) Run query through connection

// (4) Check result of query using code below

// if rows found set authenticated user to the user name entered 
if (mysql_num_rows($result) > 0) { 
$_SESSION["authenticatedUser"] = $username;
// Relocate to the logged-in page
header("Location: loggedon.php");
} 
else
// login failed redirect back to login page with error message
{
$_SESSION["message"] = "Could not connect as $username " ;
header("Location: login.php");
}
?>

Answer 2

"SELECT * FROM USERS where Username='$username' AND Password='$password'";

Put a semicolon at the end and try