You're usage is wrong, but the error doesn't match your code. The line does, and the actual syntax error appears to as well, so methinks its been modified since providing it here.
You cannot use mysql_num_rows with a second parameter (or third). It only takes a resource. A count will always provide at least 1 record. Given the error you have, I expect that this is actually mysql_result, which does accept a second parameter to indicate the field (and matches your error itself). Dropping the count aggregate seems easier, then you can just count the results with mysql_num_rows, which should be 1 or 0. If its more than one, you have a unique constraint issue on your hands since it allows multiple users with the same username and password (which chances are you will not have).
The error you have overall is a failure of your query itself. Since the variable names are correct, that indicates that the result of a mysql_query has returned false, which in the event of a select is a SQL syntax error. Check your column names to verify. You can add an
or die(mysql_error()); chain to the mysql_query itself to dump a mysql error on a failure.