şifreyi yanlış girdiğimde bile giriş yapıyor

<?php
                ob_start();
                session_start();                
                include 'config.php';              
                  if($_POST)
                  {
                  $username = $_POST['username'];
                  $password = $_POST['password'];                  
                  $sql = "SELECT * FROM users where username='$username' or mail='$username' and password='$password'";
                  $sonuc = $baglanti->query($sql);
                  if ($sonuc->num_rows > 0)
                  {
                  $_SESSION["login"] = "Giriş yapılıyor...";
                    header("Refresh:1; url=./homepage.php");
                  }
                  else{                  
                    $_SESSION["error"] = "Kullanıcı adı veya Şifreniz yanlış!";
                  }                  
                  echo '<br>  '. $_SESSION["error"];    
                  }
                ?>

or mail='$username'

(username='$username' or mail='$username')

$sql = "SELECT * FROM users where (username='$username' or mail='$username') and password='$password'";

$salt = "hernagibirkelime";
$salt_pw = md5(sha1($passwork.$salt));
$sql = "SELECT * FROM users where (username='$username' or mail='$username') and password='$salt_pw'";

$sql = "SELECT * FROM users where (username='$username' or mail='$username') and password='$password'";

$salt = "hernagibirkelime";
$salt_pw = md5(sha1($passwork.$salt));
$sql = "SELECT * FROM users where (username='$username' or mail='$username') and password='$salt_pw'";

$salt_pw = md5($password);
                    $sql = "SELECT * FROM users where (username='$username' or mail='$username') and password='$salt_pw'";