if ($_GET['task'] == "login") {
    $user = addslashes($_POST['user']);
    $pass = md5($_POST['pass']);

    $query = "SELECT * FROM users WHERE username='$user' and password='$pass'";
    $user = mysql_fetch_array(mysql_query($query));
    if ($user['uid'] == "") header("location:./?strana=home&notification=badlogin");
    else {
    $_SESSION['uid'] = $user['uid'];
    $_SESSION['user'] = $user['user'];
    if ($user['head'] == "1")
    $_SESSION['head'] = $user['head'];
    header("location:./?strana=admin");
    }
}