我对您的代码有很多疑问（不要使用md5进行密码散列，而是使用php内置散列方法）。但是继续担任@nicolas的职务
根据杰伊·布兰查德的建议编辑

// Make sure your session is started
session_start();    

if (count($errors) == 0){
    // Make sure to store your passwords with the same function
    $password = password_hash($password, PASSWORD_DEFAULT ); 
    // Prepare your query with placeholders
    $query = $pdo->prepare('SELECT username, password, email FROM trackowners WHERE username=? AND password=?');
    // Execute your query
    if($query->execute(array($username, $password)))
    {
        // Loop through result set
        while ($row = $query->fetch(PDO::FETCH_ASSOC)) {
            $_SESSION['username'] = $row['username'];
            $_SESSION['email'] = $row['email'];
            $_SESSION['success'] = "You are now logged in";     
        }
        header('location: index.php');  
    }
    else
    {
        array_push($errors, "Wrong username/password combination"); 
    }
}

正如@nicolas所提到的，他读了一些准备好的语句来防止sql注入。

实际上，您从未从查询结果中访问数据。你需要使用 $result 变量来设置会话变量。

if (count($errors) == 0){
$password = md5($password); 
$query = "SELECT username, password, email FROM trackowners WHERE username='$username' AND password='$password'"; 
$results = mysqli_query($db, $query); 
if (mysqli_num_rows($results) == 1) {
  // Here i'm accessing the results data from your query
  $data = mysqli_fetch_assoc($result)[0];
  //The data is an associative array. 
  $_SESSION['username'] = $data['username'];
  $_SESSION['success'] = "You are now logged in";
  $_SESSION['email'] = $data['email'];
  header('location: index.php');
}else {
  array_push($errors, "Wrong username/password combination");
} 
}

我还想提到的是，您的代码容易受到sql注入的攻击。你应该尝试绑定你的参数。