<?php

session_start();


$username = $_POST['username'];
$password = $_POST['password'];
$pwsecure = md5("$password");


if ($username&&$password){

include "config.php";

$query = mysql_query("SELECT * FROM userinfo WHERE username='$username'");
$numrows = mysql_num_rows($query);

if ($numrows!=0){

    while ($row = mysql_fetch_assoc($query)){
        $dbusername = $row['username'];
        $dbpassword = $row['password'];
    }

    //check to see if they match
    if ($username==$dbusername&&$pwsecure==$dbpassword){
        $_SESSION['username']=$dbusername;
        echo "Welcome, ".$dbusername;
    }
    else {
        echo "wrong password.";
    }
}
else
    echo "Couldnt find the user.";


}
else {
    die("Please enter a username & a password.");

}



?>