<?php
include('connection.php');

session_start();

if(isset($_SESSION['logged'])) die(header("location: index.php"));

if(isset($_POST['submitted']) && $_POST['submitted'])
{
	$con = @mysql_connect($MySQLhost, $MySQLuser, $MySQLpass) or die('MySQL error, retry!');
	$db = @mysql_select_db($MySQLdata, $con) or die('MySQL error, retry!');

	if(isset($_POST['username']) && $_POST['username'] && isset($_POST['password']) && $_POST['password'])
	{

		$username = $_POST['username'];

		$password = md5(mysql_real_escape_string($_POST['password']));

		$query = "SELECT * FROM `users` WHERE `username`='" . mysql_real_escape_string($username) ."' AND `password`='" . $password . "'";
		$result = @mysql_query($query) or die('MySQL error, retry!');

		if(!mysql_num_rows($result)) die('Invalid login, retry!');

		$_SESSION['logged'] = 1;
		$_SESSION['username'] = $username;

		if($con) @mysql_close($con) or die('MySQL error, retry!');

		die('Logged in successfully!');
	}
	else
	{
		die('Invalid input - retry!');
	}
}
?>
<form method="POST" action="login.php">
	<input type="hidden" name="submitted" value="1">
	Username: <input type="text" name="username"><br>
	Password: <input type="password" name="password"><br><br>
	<input type="submit" value="submit">
</form>