if ($_GET['task'] == "login") {
    $user = addslashes($_POST['user']);
    $pass = md5($_POST['pass']);

    $query = "SELECT * FROM users WHERE username='$user' and password='$pass'";
    $user = mysql_fetch_array(mysql_query($query));
    if ($user['uid'] == "") header("location:./?strana=home&notification=badlogin");
    else {
    while($row = mysql_fetch_array(mysql_query($query))) {
        $head = $row['head'];
        if ($head== '1'){
        $_SESSION['head'] = $user['head'];
        }
    }
    $_SESSION['uid'] = $user['uid'];
    $_SESSION['user'] = $user['user'];
    header("location:./?strana=admin");
    }
}