Untitled

<?php
	if (!isset($_POST['username']) || !isset($_POST['password']))
	{
?>
	<html>
		<head>
			<title>Login</title>
		</head>
		<body>
			<form method="POST" action="login.php">
				Username <input name="username" type="text"><br>
				Password <input name="password" type="password"><br><br>
				<input type="submit" value="Accedi">
			</form>
		</body>
	</html>
<?php
	}
	else
	{
?>
	<html>
		<head>
			<title>Login</title>
		</head>
		<body>
			<?php
				$username = $_POST['username'];
				$password = $_POST['password'];
				if (strlen($username) != 0 && strlen($password) != 0)
				{
					$connection = @ new mysqli("localhost","root","","biblioteca");
					$query = "SELECT * FROM utenti WHERE username = '$username'";
					$result =  @ $connection->query($query);
                    if($connection->errno){
	                @ $connection->close();
	                die("Errore nell'esecuzione della query");
                    }
                    if($connection->errno){
	                @ $connection->close();
	                die("Errore nell'esecuzione della query");
                      }
					if (@$result->num_rows == 0)
					{
						echo "Utente $username sconosciuto: ";
						echo "<a href=\"http://localhost/marco/login.php\">riprova.</a><br>";
					}
					else
					{
						$user_row =  @$result->fetch_array();
						$password = crypt($password,0);
						if ($password == $user_row['password'])
						{
							echo "Password corretta: ";
							echo "<a href=\"http://localhost/marco/biblioteca.php\">accedi.</a><br>";
                            session_start();
							session_unset();
							session_destroy();
							session_start();
							$_SESSION['username'] = $username;
							$_SESSION['start_time'] = time();
							$_SESSION['DB_username'] = $user_row['DB_username'];
							$_SESSION['Db_password'] = $user_row['DB_password'];
							echo "<a href=\"http://localhost/marco/logout.php\"> [$username logout]</a>";
						}
						else
						{
							echo "Password errata: ";
							echo "<a href=\"http://localhost/marco/login.php\">riprova.</a>";
						}
					}
					@ $result->free();
					@ $connection->close();
				}
				else
				{
					echo "Username/password non validi: ";
					echo "<a href=\"http://localhost/marco/login.php\">riprova.</a>";
				}
			?>
		</body>
	</html>
<?php
	}
?>