Error counting rows

I'm making a login and I get an error with counting the number of rows from a MySQL query. The error is below.

 Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /home/nzcraftn/public_html/bs/login.php on line 13

Warning: Cannot modify header information - headers already sent by (output started at /home/nzcraftn/public_html/bs/login.php:13) in /home/nzcraftn/public_html/bs/login.php on line 21

I am using this code for the login.

<?php
session_start();
include('config.php');

$user = protect($_POST['username']);
$pass = protect($_POST['password']);

$salt = "a123b123";
$thepass = md5($salt.md5($pass));

$res = mysql_query("SELECT `username`,`password` WHERE (`username` = '$user' AND `password` = '$thepass')");

$count = mysql_num_rows($res);

if($count == 1) {
$_SESSION['user'] = $user;
print($_SESSION['user']);
//header('Loca开发者_开发知识库tion: /panel/index.php');
} else {
$_SESSION['errormsg'] = "<div style='color: #FF0000'>Invalid Login!</div>";
header('Location: index.php');
}
?>

---

You have an error in your statement, so mysql_query is returning false. Please add error checking (and logging for debugging) to your code.

(Your SELECT is missing a FROM clause.)

---

Make sure that the SQL query is working correctly by running it in the MySQL prompt yourself. Add some troubleshooting code around your SQL queries like this:

$query = 'SELECT ...';
$res = mysql_query($query) or die(mysql_error()."\n".$query);