用户不能使用有效的电子邮件和密码登录到他的帐户

我有一个登录表单，将信息传输到同一页面的PHP代码，但即使用户名和密码是正确的，它总是忽略他这是我的PHP代码:

$mail = test_input($_POST["email"]);
//check if the email address format is valid
  if (!filter_var($mail, FILTER_VALIDATE_EMAIL)) {
  echo "<h3>Invalid email format</h3>";
  }
$pass = trim($_POST["password"]);
$stmtn="SELECT first_name, email , password FROM `users` WHERE email= '$mail'";
$result = mysqli_query($connection,$stmtn);
$rows=  mysqli_fetch_assoc($result);
if($rows && $rows['password']==  md5($pass)){
    session_start();
    $_SESSION['username']=$rows['first_name'];
    header("Location: index.php");
}else{
    echo "<h3> Sorry! your email or password is incorrect </h3>";
    echo "<h3> Please <strong><a href='login.php'>login</a></strong> again to your account </h3>";
    echo var_dump($rows);

}

else部分的语句总是被执行，数组$rows的var_dump的结果等于数据库中的信息

<?php
function test_input($data) {
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlspecialchars($data);
  return $data;
}