Untitled

<?php
ob_start();
if(isset($_SESSION['user'])){
	if($_SESSION['user']==1){
		header("admin.php");
	}
	else if($_SESSION['user']==0)	{
		header("noruser.php");
	}
}
?>
<html>
<body>
<form action="login.php" method="post">
Username:<input type="text" name="user" />
Password:<input type="password" name="pass" /><br><br><br>
<input type="Submit" value="login" />
</form>
<?php
if(!isset($_SESSION['user'])){
	$user=htmlentities($_POST["user"]);
	$pass=htmlentities($_POST["pass"]);
	$con=mysql_connect("localhost","root");
	if(!$con){
		die('Could not Connect:'.mysql_error());
	}
	mysql_select_db("site", $con);
	$result = mysql_query("SELECT Password FROM login1 WHERE Username = '$user'") or die('No such user');
	$row=mysql_fetch_assoc($result);
	$passtest=$row["Password"];
	if(empty($user) || empty($pass)){
		echo("<div id='alert' style='background-color:red;font-size:100px;font-family:Bleeding Cowboys;width:1430px;height:140px;'><center>Please enter all fields</center><div>");
	}
	else if($pass !== $passtest){
		echo("<div id='alert1' style='background-color:red;font-size:100px;font-family:Bleeding Cowboys;width:1430px;height:230px;'><center>Wrong password and/or username</center></div>");
	}
	else if($pass == $passtest)
	{
		$result=mysql_query("SELECT Status from login1 WHERE Username='$user'");
		$row1=mysql_fetch_assoc($result);
		echo("Logged in");
		echo("<br />");
		if($row1['Status'] == 1){
			$_SESSION['user'] = 1;
			echo("<div class='alert'>You are admin</div>");
			header("admin.php");
		}
		else if($row1['Status'] == '0'){
			$_SESSION['user'] = 0;
			echo("shit");
			header("noruser.php");
		}
	}
	mysql_close($con);
	echo("<br /><br /><br /><br />");
}
else{
	echo("You have already logged in and are not supposed to login again, please disble the option in your browser where it disallows sites to automatically redirect you and reload the page or directly go to the page you are supposed to if you remember the URL. Thank You.");
}
?>
</body>
</html>