<?php
include ('db.php');
if(isset($_POST['login'])){
//////////////////////////////////////////////////
//( STAP 1 ) Query die kijkt of de data overeen//
//komt(dit staat boven zodat het direct update//
///////////////////////////////////////////////
	$sql = "SELECT * FROM users WHERE username='".mysql_real_escape_string($_POST['username'])."' and password='".md5($_POST['password'])."'";
	$result = mysql_query($sql) or die(mysql_errorlogin());
	$row = mysql_fetch_assoc($result);
	if(mysql_num_rows($result) == 1){
		$_SESSION['id'] = $row['id'];
	}
	else{
		$errorlogin = "Wrong username or password";
	}
}
///////////////////////////////////////////////////////////
//( STAP 2) login form laten zien als niet ingelogd zien//
/////////////////////////////////////////////////////////
if(!isset($_SESSION['id'])){
	echo "<form method='post' action=''>
			<div class='table'>Username:</div>
			<div class='field'><input name='username' type='text' value='' size='28'/></div>
			<div class='table'>Password:</div>
			<div class='field'><input name='password' type='password' value='' size='28'/></div><br />
			<div class='field'><input name='login' type='submit' value='Login' style='height: 25px; width: 195px' /></div>
			<div class='table' align='center'><a href='register.php'>Register</a></div><br />
			<div class='table' align='center'></div>
		</form>";
}
/////////////////////////////////////////////////////////////
//( STAP 3 )als er al een sessie is laat hij een menu zien//
///////////////////////////////////////////////////////////
else if(isset($_SESSION['id'])){
	$query = mysql_query("SELECT * FROM users WHERE id = '".mysql_real_escape_string($_SESSION['id'])."'");
	$row = mysql_fetch_assoc($query);
	//admin menu//
	if($row['admin'] == 1){
		echo "
			Hey, " . $row['username'] ."<br />
			What are you gonna do today?<br /><br />
			<a href='admin.php'>Admin panel</a><br />
			<a href='editprofile.php'>Edit profile</a><br />
			<a href='logout.php'>Logout</a>";
	}
	//user menu//
	else{
		echo "
			Hey, " . $row['username'] ."<br />
			This is your profile!<br />
			<a href='editprofile.php?username=".$row['username']."'>Edit profile</a><br />
			<a href='logout.php'>Logout</a>";
	}
}
if(isset($errorlogin)){
	echo $errorlogin;
}
?>