// collect data from form
$user=$_POST['user'];
$pass=$_POST['pass'];

// protect from an SQL injection
$user = stripslashes($user);
$pass = stripslashes($pass);
$user = mysql_real_escape_string($user);
$pass = mysql_real_escape_string($pass);

//encrypt
$newPass=md5($pass);

$sql="SELECT * FROM $tbl_name WHERE username='$user' and password='$newPass'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1) {
// Register $myusername, $mypassword and redirect to file "login_success.php"
	session_register("user");
	header("location:login_success.php");
}
else {
	echo "Wrong Username or Password";
}
?>