<?php
//new user clicked
if($_GET['action'] == "newuser") {
   $newuser = true; }

//new user
if($_POST) {
   $createuser = mysql_escape_string($_POST['createuser']);
   $createname = mysql_escape_string($_POST['createname']);
   $createpass = mysql_escape_string($_POST['createpass']);
   $createpass2 = mysql_escape_string($_POST['createpass2']);
   $createaccess = mysql_escape_string($_POST['createaccess']); }


if (!empty($createuser) && !empty($createname) && !empty($createpass) && !empty($createpass2)) {

//check access
if ($createaccess == "employee") {
   $createaccess = '0'; }
elseif ($createaccess == "supervisor") {
   $createaccess =  '2'; }

//check for username
$usertest = mysql_query("SELECT * FROM users WHERE username = '$createuser'");
if ($usertest > 0) {
$stop = true; }


if ($createpass == $createpass2 && !$stop) {
    mysql_query("INSERT INTO users (username, password, real_name, access, status, id) VALUES ('$createuser', MD5('$createpass'), '$createname', '$createaccess', '0', NULL);");
   $created = "yes";
}

else {
   $created = "no"; }
?>