为什么我的验证码输入错误也可以跳转页面

Question

<?php

session_start();

header('Content-type:text/html;charset=utf-8');

$code = $_POST["code"]; //验证码

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

    if (empty($_POST['username'])){

        echo "<script>alert('用户名不能为空！');location.href='login.html';</script>";

    }else {

        $username=$_POST['username'];

    }

    if (empty($_POST['password'])){

        echo "<script>alert('密码不能为空！');location.href='login.html';</script>";

    }else{

        $password=$_POST['password'];

    }

}

if($code != $_SESSION['authcode']) //判断填写的验证码是否与验证码PHP文件生成的信息匹配

{

echo "<script type='text/javascript'>alert('验证码错误!');location='login.html';</script>";

}

$mysqli = new mysqli('localhost', 'root', 'root', 'user');

$result = $mysqli->query("SELECT password FROM user WHERE username = "."'$username'");

$rs=$result->fetch_row();

if (!empty($rs)){

    if ($password != $rs[0]) {

        echo "<script>alert('密码错误！');location.href='login.html';</script>";

    }else{

        $expire=3600;

        ini_set('session.gc_maxlifetime', $expire);//保存1小时

        if (empty($_COOKIE['PHPSESSID'])) {

            session_set_cookie_params($expire);

            session_start();

        }else{

            session_start();

            setcookie('PHPSESSID', session_id(), time() + $expire);

        }

        if(isset($_SESSION['username'])){

           header("location:index.html");

        }else{

            $_SESSION['username']=$_POST['username'];

        }

        echo "<script>alert('登录成功！');</script><br>";

        echo "您好！{$_SESSION['username']},欢迎回来！";

        echo "<a href='logout.php'>注销</a>";

    }

}else{

    echo "<script>alert('没有此用户！');location.href='login.html';</script>";

}

?>