It looks like your issue is here probably
$username = mysqli_real_escape_string($db, $_POST['user']);
Your error message doesn't match up with the code you posted but it is pretty clear. Your POST to login.php does not contain a "user" field. Check what you are posting to make sure "user" is one of the form vars being passed to login.php.
You can use a tool like fiddler, chrome dev tools, or firebug/firefox dev tools to see what is being posted.