Untitled

<?php
session_start();
$errorMessage = '';
if (isset($_POST['txtUserId']) && isset($_POST['txtPassword'])) {

   include 'connect.php';
   $userId = $_POST['txtUserId'];
   $password = $_POST['txtPassword'];

   $ip = $_SERVER['REMOTE_ADDR'];
   if(is_dir('Logs/')==false) {
     	mkdir("Logs", 0777);
   }
   $filename = 'Logs/auth_logfile.txt';
   $fp = fopen($filename, "a");

   $sql = "SELECT * FROM logon WHERE user = '$userId' AND password = '$password'";

   $result = mysql_query($sql)
             or die('Query failed. ' . mysql_error());

   if (mysql_num_rows($result) == 1) {

      $row = mysql_fetch_object($result);
      $_SESSION['db_is_logged_in'] = true;
      $_SESSION['username'] = $row->user;
      $_SESSION['id'] = $row->ID;
      $_SESSION['clasa']= $row->clasa;
      $_SESSION['level']= $row->level;
      if($row->level==1)
      {
      	$now=date("d.m.Y --- G:i:s");
		$toFile = "$ip --- $now --- $row->user --- $row->clasa --- $row->level --- s-a logat\r\n";
		$write = fputs($fp, $toFile);
      	header('Location: adminpage.php');
      	exit;
      }
      else
      {
            $now=date("d.m.Y --- G:i:s");
			$toFile = "$ip --- $now --- $row->user --- $row->clasa --- $row->level --- s-a logat\r\n";
			$write = fputs($fp, $toFile);
        	header('Location: main.php');
        	exit;
      }
   } else {
      $errorMessage = 'Nume utilizator sau parola incorecta';
   }

mysql_close($connection);
fclose($fp);

}

?>
<html>
<link rel="stylesheet" href="css/style.css" type="text/css">
<head>
<title>Autentificare</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<?php
if ($errorMessage != '') {
?>
<p align="center"><strong><font color="#990000"><?php echo $errorMessage; ?></font></strong></p>
<?php
}
?>