"Because user input is from html"
I believe you confuse between the HTML your PHP script is going to output as a response , and between the HTML <form>
that triggered the request.
the HTML in your question is not going to be PARSED by the PHP, instead it is going to be outputted as a response to client request that triggered this PHP script.
That confusion may be happened because your PHP script is outputting the HTML form, and also it process the request comes from that HTML form.
PHP is about the work of building the final HTML to output.
For example:
On the client side whether it is an HTML <form>
running by a browser , or C# bot, or JAVA application , or whatever program is going to send the http request to your server(PHP script) , suppose you send this request with these parameters
Request URL: "http://www.example.com/index.php"
Request method: "POST"
Request parameters: "username=myname&password=123"
that request is going to trigger the PHP to parse the index.php
script on the server
On the Server side your web server is going to execute the index.php
after filling out the request parameters so you can use them in your code.
before triggering index.php
$_POST['username'] = $_REQUEST['username'] = "myname";
$_POST['password'] = $_REQUEST['password'] = "123";
now as you have the request parameters let's call index.php
<?php
include('login.php'); // Includes Login Script
if(isset($_SESSION['login_user'])){
//check if user is authentic then redirect him to the profile page.
header("location: profile.php");
//you should exit; your code here
//see: https://stackoverflow.com/questions/2747791
}
/*now any string that is not between the php open and close tags <> is parsed as
HTML that needs to be outputted*/
?>
<!-- for example this HTML is going to be outputted ,and the browser is going to show it
unless you used the location header -->
<!DOCTYPE html>
<html>
<!-- your log in form here -->
</html>