<?php

// Inialize session
session_start();

// Include database connection settings
include('config.inc');

// Retrieve username and password from database according to user's input
$login = mysql_query("SELECT * FROM user WHERE (username = '" . mysql_real_escape_string($_POST['username']) . "') and (password = '" . mysql_real_escape_string(md5($_POST['password'])) . "')");

// Check username and password match
$id = mysql_query("SELECT status FROM user");
while($row = mysql_fetch_array($id))
   {
   $status = $row['status'];
   }
if($status==1)
{
if (mysql_num_rows($login) == 1) {
        // Set username session variable
        $_SESSION['username'] = $_POST['username'];
        // Jump to secured page
        header('Location: index.php');
}
else {
        // Jump to login page
        header('Location: login.php');
}
}
else
{
die();
}
?>