<?php
$user = $_POST["username"];
$pass = $_POST["password"];
$validated = false;

session_start();
$_SESSION['login'] = "";
if($user!="" && $pass!="")
{
	$conn = @mysql_connect("localhost","root","") or die ("Sorry - unable to connect to database.");
	$rs = @mysql_select_db("admin",$conn) or die ("error");
	$sql = "SELECT * FROM user WHERE username = '$user' AND passowrd = '$pass'";
	$rs = mysql+num_rows($rs);

	if($result > 0) $validated = true;
	if($validated)
	{
		$_SESSION['login'] = $OK;
		$_SESSION['username'] = $user;
		$_SESSION['password'] = $pass;
		header('Location: protected.php');
	}
	else
	{
		$_SESSION['login'] = "";
		echo "Invalid username or password.";
	}
}
else $_SESSION['login'] = "";
?>