<?php

session_start();

include 'connect.php';

$username = $_POST['username'];
$password = $_POST['password'];
$password = md5(md5($password));

if ($username&&$password){
$query = mysql_query("SELECT * FROM members WHERE username='$username'");

$numrows = mysql_num_rows($query);

if ($numrows!=0)
{

while ($row = mysql_fetch_assoc($query))
{
    $dbusername = $row['username'];
    $dbpassword = $row['password'];

}
if ($username==$dbusername&&$password==$dbpassword){
if (!$row['banned'])
{
$_SESSION['username'] = $username;
echo "Welcome , ".$_SESSION['username']." Enter the <a href='members.php'>members</a> page now <a href='changepassword.php'>Change password</a>";


}
else
{
header("Location: banned.php");
}

}
else
{
    echo "Incorrect Password!";
}
}
else
{
    die("That user doesn't exist!");

}
}
else
{
     die("Please enter a username and password");
}

?>