<?php
session_start();
?>
  <form id = "login" method = "post" action = "<?php echo $_SERVER['PHP_SELF'];?>"/>
  <h3> Login </h3>
  Please enter your name:
  <input type = "text" size = "5" id = "username"/>
  <br />
  Please enter your password:
  <input type = "password" size = "5" id = "password"/>
  <input type ="submit" name = "submit" value = "Log in"/>
  <?php
  $conn = mysql_connect("localhost", "root", "") or die("cannot connect server ");
mysql_select_db("nightsout") or die ("cannot find database");

if(isset($_POST['submit']))
{
	$username = $_POST["username"];
	$password = $_POST["password"];

	$username = stripslashes($username);//to protect from mysql injection
	$password = stripslashes($password);//to protect from mysql injection
	$username = mysql_real_escape_string($username);//to protect from mysql injection
	$password = mysql_real_escape_string($password);//to protect from mysql injection

	$checklogin = ("select * from users WHERE username = '$username' && password = '$password'") or die('Cannot Execute:'. mysql_error());
	$result = mysql_query($checklogin);
	$rows = mysql_num_rows($result);
	if(mysql_num_rows($rows) != '0' && '1')
	{
		session_register("username");
		session_register("password");
		?>
		<p> you have successfully logged in</p>
		<?php
	}else
	{
	?>
	<p> Either your username or password was wrong or you are not registered, <a href="signup.php">click here</a> to register. </p>
	<?php
	}
mysql_close($conn);
}
?>