<?php
// init
$username = $_POST['username'];
$password =$_POST['password'];
$submit = $_POST['submit'];

if (($_POST['submit']))
{
    connect();
    $username = mysql_real_escape_string($_POST['username']);
    $password = mysql_real_escape_string($_POST['password']);
    if (isset($username) && isset($password))
    {
        $sql = "SELECT username,password FROM users WHERE username = '$username'" OR die(mysql_error());
       $res = mysql_query($sql);
       if ($res = mysql_query($sql))
       {
            if (mysql_num_rows($res) > 0)
            {
            $sql2 = "SELECT id FROM users WHERE username = $username AND password = sha1($password)";
            $res2 = mysql_query($sql2);
                if (mysql_num_rows($res2) > 0)
                {
                $row = mysql_fetch_assoc($res2);
                $_SESSION['uid'] = $row['id'];
                echo "You have successfully logged in, $username .<br><br><a href=\"./index.php\">Click here to go to the forums.</a>";
                }
                else
                {
                die ("Username and password combination are incorrect!");
                }
        }
        }
        else
        {
            die("User does not exist!");
        }
    }
    else
    {
    die("Please fill in all fields!");
    }
}

?>