<?php

  session_start();

  $username = $_POST['username'];
  $password = $_POST['password'];

  if($username&&$password)
  {
    $connect = mysql_connect("localhost","root","") or die("Couldn't connect");
    mysql_select_db("syntax") or die("Couldn't find database");

    $query = mysql_query("SELECT * FROM users WHERE username='$username'");

    $numrows = mysql_num_rows($query);

    if ($numrows!=0)
    {
      //login code
      while ($row = mysql_fetch_assoc($query))
      {
        $dbusername = $row['username'];
        $dbpassword = $row['password'];
      }

      //check to see if they match
      if($username==$dbusername&&md5($password)==$dbpassword)
      {
        echo "You have logged in sir. <a href='member.php'>Go to members area</a>";
        $_SESSION['username']=$username;
      }
      else
        echo "Incorrect Password";
    }
    else
      die("That user doesn't exist");

  }
  else
    echo "Please enter a username and a password.";

?>