<?php
include("includes/mysql_connector.php");

$username = mysql_real_escape_string(stripslashes($_POST['u']));
$password = md5($_POST['p']);
$verion = $_POST['ver'];

$username_result = mysql_query("SELECT * FROM aq_users WHERE username = '" . $username . "'") or die(mysql_error());

if (mysql_num_rows($username_result) > 0) {
    $user_result = mysql_query("SELECT * FROM aq_users WHERE username = '" . $username . "' AND password = '" . $password . "'") or die(mysql_error());

    if (mysql_num_rows($user_result) > 0) {
        echo("&status=success&");

        $x = 1;
        $char_result = mysql_query("SELECT * FROM aq_characters WHERE username = '" . $username . "'");
        while ($char = mysql_fetch_array($char_result)) {
            echo("id" . $x . "=" . $char['id'] . "&");
            echo("char" . $x . "=" . $char['charname'] . "&");
            echo("level" . $x . "=" . $char['level'] . "&");
            echo("intCharType" . $x . "=" . $char['type'] . "&");
            echo("turns" . $x . "=15&");
            $x++;
        }

        $user = mysql_fetch_assoc($user_result);
        echo("intCanEmail=" . $user['confirmed'] . "&");
    } else {
        echo("&status=badpassword");
    }
} else {
    echo("&status=usernotfound");
}
?>