Zabezpečenie proti XSS - ako nato

<form class="login-form" method="post" action="index.php">
      <input type="text" name="Username" placeholder="Meno"/>
      <input type="password" name="Password" placeholder="Heslo"/>
      <button type="submit" name="odoslat">PRIHLÁSIŤ</button>
    </form>

<?php
include("functions.php");
session_start();
 if(isset($_POST['odoslat'])){
    $username = ($_POST['Username']);
    $password = ($_POST['Password']);
    $login_check = mysqli_query($con,"SELECT `UserID` FROM `Users` WHERE `Username`='$username' AND `Password`='".sha1($password)."'") or die (mysqli_error());
    if(mysqli_num_rows($login_check) == 0){
      $echo = "Nesprávna kombinácia mena/hesla!"; 
    }else{
        $get_id = mysqli_fetch_assoc($login_check);
        $_SESSION['uid'] = $get_id['UserID'];
        $today = date("Y-m-d H:i:s");
        $t = file_get_contents("prihlasenia.txt");
      $t .= $today." Používateľ ".$username." "."sa prihlásil!"."\r\n";
      file_put_contents("prihlasenia.txt",$t);
       header("Location: system.php");           
      }       
    }
  ?>