if (isset($_POST["user_login"]) && isset($_POST["password_login"])) {

$user_login = preg_replace('#[^A-Za-z0-9]#i', '', $_POST["user_login"]); //

filter everything but numbers and letters

  $password_login = preg_replace('#[^A-Za-z0-9]#i', '',

  $_POST["password_login"]); // filter everything but numbers and letters

  $password_login_md5 = md5($password_login);

  $sql = mysql_query("SELECT id FROM users WHERE username='$user_login' AND

 password='$password_login_md5'  LIMIT 1"); // query the person

 //Check for their existance

 $userCount = mysql_num_rows($sql); //Count the number of rows returned

  if ($userCount == 1) {

    while($row = mysql_fetch_array($sql))  {

         $id = $row["id"];
}

     $_SESSION["user_login"] = $user_login;

     header("location:index.php");
     exit();
    } else {
    echo 'That information is incorrect, try again';
    exit();
}