Hi,
I wouldn't recommend using the above, there are 2 fundamental flaws I can see without looking in to it deeply.
Firstly, if you provide an incorrect username or password, it will give you an error for using fetch array (unless you hide errors), in any case, you should atleast use a row check before fetching an array.
Secondly, if I submitted the username as admin' --' followed by the password of test--, that would create the query:
SELECT
*
FROM tbladmins
WHERE
username='admin' [i][size="1"]--' AND
password='test--'[/size][/i] AND roleid='1'
Not a SQL query I would like executing login authentication. Add some security to your queries, otherwise you may aswell give away your MySQL Login details than use an API.
Best,