<?php

session_start();
include 'config.php';

if (isset($_GET['logged']))
{
  $username = htmlspecialchars($_POST['username']);
  $password = htmlspecialchars($_POST['password']);

  $check = mysql_query("SELECT * FROM `users` WHERE `username` = '$username'")
    or die(mysql_error());

  $data = mysql_fetch_array($check);

  if (mysql_num_rows($check) == '0')
  {
    echo "Don't try that one sonny";
  }

  else
  {
    if ($data['password'] == $password)
    {
      $fetchd = mysql_query("SELECT * FROM `users` WHERE `username` = '$username'")
        or die(mysql_error());

      $fetchu = mysql_fetch_array($fetchd);

      $_SESSION['id'] = "$user[id]";
      $_SESSION['password'] = "$user[password]";

      echo "You are now logged in";
      echo "<meta http-equiv='refresh' content='2; URL=index.php'";
    }
  }
}

else
{
  echo "
<form method='post' action='login.php?logged' />
  Username:<br />
  <input type='text' name='username' /><br />

  Password:<br />
  <input type='password' name='password' /><br />

  <input type='submit' name='submit' value='Submit' />
</form>
";
}

?>