<?php
    session_start();
    require("configuration.php");

        if(isset($_GET['login']))
        {

            $username = $_POST['username'];
            $password = md5(sha1(md5(sha1($_POST['password']))));

            if(!$username || !$password)
            {

                echo("All fields are required.");

            }
            else
            {

                $uinfo = mysql_query("SELECT * FROM `users` WHERE `username` = '$username'");//SQL injection
                $userdata = mysql_fetch_assoc($uinfo);

                if($userdata[password] = $password)
                {
                    $_SESSION['id'] = "$userdata[id]";
                    $_SESSION['password'] = "$userdata[password]";
                    echo("Incorrect Username and Password!");

                }
                else
                {
                    echo("Welcome $logged[username");
                }

            }

        }
        else
        {
            echo("<form action=\"index.php?login\" method=\"post\">
            <input type=\"text\" name=\"username\" /><br />
            <input type=\"password\" name=\"password\" /><br />
            <input type=\"submit\" name=\"submit\" value=\"Login\" /><br />
            <br /><strong>Your IP will be logged ($_SERVER[REMOTE_ADDR])</strong>
            </form>");
        }

?>