<?php
session_start();
include ('connect.php');

if ($_POST['submit']){
    //get data



    $username = $_POST['user'];
    $password = $_POST['pass'];

    if ($username && $password) {
                $password = md5($password);
        $query = mysql_query("SELECT * FROM users WHERE  user='$username' AND pass='$password'");

        while ($getrows = mysql_fetch_assoc($query)){

        $dbuser = $getrows['user'];
        $dbpass = $getrows['pass'];

        }
            if (($username == $dbuser) && ($password == $dbpass)) {

            $_SESSION['user'] = $username;
            header("location:index.php");
    } else {
    echo "Login Failed";
    }
} else {
    die("username and password fields should not be left empty");
}
}

?>