bagaimana cara membatasi user masuk ke form admin

ketika saya memasukan username sama password 'user' dan pilih opsi level admin dia tetap masuk ke halaman admin, nah cara membatasinya gimana ya?

ini kodingan saya

<?php

include ("conn.php");

date_default_timezone_set('Asia/Jakarta');

session_start();

$username = $_POST['username'];

$password = $_POST['password'];

$level = $_POST['level'];

$username = mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $username);

$password = mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $password);

$level = mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $level);

if (empty($username) && empty($password) &&($level)) {

header('location:login.php');

} else if (empty($username)) {

header('location:login.php');

} else if (empty($password)) {

header('location:login.php');

} else if (empty($level)) {

header('location:login.php');

}

$q = mysqli_query($GLOBALS["___mysqli_ston"], "select * from admin where username='$username' and password='$password'");

$row = mysqli_fetch_array($q);

if (mysqli_num_rows($q) == 1) {

    $_SESSION['user_id'] = $row['user_id'];

$_SESSION['username'] = $username;

$_SESSION['fullname'] = $row['fullname'];

    $_SESSION['gambar'] = $row['gambar'];

    $_SESSION['level'] = $row['level'];

if($level == "User"){

    header('location:user/index.php');

    } elseif ($level == "Admin"){

    header('location:admin/index.php');

    }

}

else {

echo "<script>alert('Username atau Password salah!'); window.location='login.php'</script>";

}