$query = "insert login(username,password,level)VALUES('$username','$password','$level')";
You're using the variable $username without ever defining it. This indicates you have register_globals on, which is a security no-no.
This also means if you have $_SESSION['username'], that will overwrite the $_POST['username']. Are you administrator? That's where it's getting that from.
Instead of using variables without declaring them, you need to do $username = $_POST['username'];
You also need to read up on PHP security, things like SQL injection, and how to code without R_G.