<?php
}
else
{
  $user = protect($_POST['username']);
  $pass = protect($_POST['password']);

if($user && $pass)
{
$pass = md5($pass); //compare the encrypted password
$sql="SELECT id,username FROM `users` WHERE `username`='$user' AND `password`='$pass'";
$query=mysql_query($sql) or die(mysql_error());

    if(mysql_num_rows($query) > 0)
    {
      $row = mysql_fetch_assoc($query);
      $_SESSION['id'] = $row['id'];
      $_SESSION['username'] = $row['username'];

      echo "<script type=\"text/javascript\">window.location=\"home.php\"</script>";
    }
    else
   {
    echo "<script type=\"text/javascript\">
    alert(\"Username and password combination is incorrect!\");
    window.location=\"index.php\"</script>";
   }
}
else
{
   echo "<script type=\"text/javascript\">
    alert(\"You need to gimme a username AND password!\");
    window.location=\"index.php\"</script>";
}
}
?>