<?php
include "../includes/config.php";
session_start();
if(!isset($_SESSION['admin'])){
    if(isset($_POST['submitted'])){
        $user = mysql_real_escape_string(stripslashes($_POST['user']));
        $pass = md5($_POST['pass']);
        $query = mysql_query("SELECT * FROM `users` WHERE `user` = '".$user."' AND `pass` = '".$pass."'") or die(mysql_error());
        if ($query) {
            $_SESSION['admin'] = $user.$pass;
            echo "Login successful.";
        } else {
            echo "There was an error when you tried to login. Please don't refresh the page. This may just be a fluke.";
        }
    } else {
        echo "<form action='' method='post'>
        Username: <input type='text' name='user' /><br />
        Password: <input type='password' name='pass' /><br />
        <input type='submit' name='login' value='Login' />
        <input type='hidden' name='submitted' value='true' />";
    }
} else {
    echo "You're already logged in.";
}
?>