<?php

$conn = mysql_connect('localhost', 'engodstartsamme', 'XXXXXXXXX') or die(mysql_error());
mysql_select_db('engodstartsamme', $conn);

?>
<?
if(isset($_SESSION['user_id'])) {

    // User is logged in!
    $query = mysql_query("SELECT id, username, access FROM login
                   WHERE ID = " . $_SESSION['user_id'] . " LIMIT 1")
                   or die(mysql_error());

$access = mysql_fetch_array($query);

echo 'hej';

}else{

echo '<div id="topright"><img src="images/brugerlogin.png" id="brugerIMG"/>
<div id="form"><form action="index.php?try=true" method="post" name="loginyeah"><input type="text" id="usernameForm" name="username" /><input type="password" id="passwordForm" name="password" /></div>
<a href="javascript: submitform()"><img src="images/login.png" id="loginBTN"/></a></form></div>';

}

echo '<script type="text/javascript">
function submitform()
{
  document.loginyeah.submit();
}
</script>';

// Check if user wants to login (GET info)
if(isset($_GET['try'])) {

    // That's nice, user wants to login. But lets check if user has filled in all information
    if(empty($_POST['username']) OR empty($_POST['password'])) {

        // User hasn't filled it all in!
        echo '<font color="#810000"><b><u>Fejl:</u>Udfyld venligst alle felterne</b></font><br /><br />';

    } else {

        // User filled it all in!

        // Make variables save with mysql_real_escape_string and md5
        $username = mysql_real_escape_string($_POST['username']);
        $password = md5($_POST['password']);

        // Search for a combination
        $query = mysql_query("SELECT ID FROM login
                       WHERE username = '" . $username . "'
                       AND password = '" . $password . "'
                      ") or die(mysql_error());

        // Save result
        list($user_id) = mysql_fetch_row($query);

        // If the user_id is empty no combination was found
        if(empty($user_id)) {

            echo '<div id="loggetind2"><font color="#616161">Brugernavn eller password er ikke korrekt.</font></div>';

        } else {

            // the user_id variable doesn't seem to be empty, so a combination was found!

            // Create new session, store the user id
            $_SESSION['user_id'] = $user_id;

            // Redirect to userpanel.php
            header('location: index.php');

        }

    }

}
?>