<?PHP

$s = mysql_real_escape_string($_POST['s']);
$u = mysql_real_escape_string($_POST['u']);
$p = mysql_real_escape_string(md5($_POST['p']));

$selectuser = mysql_query("SELECT * FROM users WHERE username='$u'");
$exist = mysql_num_rows($selectuser);
while($row = mysql_fetch_assoc($selectuser)){

$id = $row['id'];
$rank = $row['rank'];
$password = $row['password'];

}

if($s) {

if($u&&$p){

if($exist!=0){

if($password==$p){

$_SESSION['badgeshop'] = $u;
session_start();
header("Location: index.php");

}
else
echo "<div class='error'>Password is completely wrong!</div>";


}
else
echo "<div class='error'>User doesn't even exist!</div>";


}
else
echo "<div class='error'>Please enter ALL fields!</div>";

}


?>