Login script prob [PHP]

<?php

session_start();

include ('mysql.php');

if (isset ($_POST['submint'])) {
$username = mysql_escape_string($_POST['username']);
$password = mysql_escape_string(sha1($_POST['password']));

if (!empty ($username) && !empty ($password)) {
$sql = mysql_query ("SELECT * FROM users
WHERE username='".$username."' AND
user_password='".$password."' LIMIT 1");

if (mysql_num_rows ($sql) > 0) {
$_SESSION['loggedin'] = true;
$_SESSION['username'] = $username;

echo 'You are now logged in!';
} else {
echo 'Your username and/or password is incorrect!';
}
} else {
echo 'You must enter a username and a password!';
}
} else {
echo '<form action="login.php" method="post">
Username: <input type="text" name="username" /><br />
Password: <input type="password" name="password" /><br />
<input type="submit" name="submit" value="login" />
</form>';
}

?>

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /var/www/web961/html/HP/login.php on line 16
Your username and/or password is incorrect!