<?php

include ('connect.php');

// username and password sent from form
$email = $_REQUEST['email'];
$password = $_REQUEST['password'];

// To protect MySQL injection (more detail about MySQL injection)
$email = stripslashes($email);
$password = stripslashes($password);
$email = mysql_real_escape_string($email);
$password = mysql_real_escape_string($password);

$sql="SELECT * FROM members WHERE username='$email' and password='$password'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);

// If result matched $myusername and $mypassword, table row must be 1 row

if($count>0){

// Register $myusername, $mypassword and redirect to file "login_success.php"
session_start("myemail");
session_start("mypassword");
header("location:accounts.php");
}
else {
echo "Wrong Username or Password";
}
?>