<?php
include("../connection.php");

$salt1 = "adfkjA(35/Sgc0adf";
$salt2 = ")=ag7fs/&1fjkdgKFSAKO)";

$mypass = md5($salt1.$_POST["password"].$salt2);

$user=$_POST['username'];
$mypassword=$mypass;

$user = stripslashes($user);
$mypassword = stripslashes($mypassword);
$user = mysql_real_escape_string($user);
$mypassword = mysql_real_escape_string($mypassword);

$sql="SELECT * FROM `users` WHERE user='$user' and pass='$mypassword'";
$result=mysql_query($sql);

$admin_mysql = mysql_query("SELECT admin_rights FROM `users` WHERE user='$user'") or die (mysql_error());
$admin_mysql = mysql_result($admin_mysql, 0);

$count=mysql_num_rows($result);

if($count==1){
if($admin_mysql==1) {

header("location: ../index.php");
session_register("user");

} elseif($admin_mysql==0) {

header("location: ../index.php");
session_register("user");

    }
}

else {
echo "Wrong Username or Password";
}
?>