Untitled

<?php
session_start();
require 'sqlconnect.php';

$user = $_POST['user'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username='" . $user . "' AND password='" . $password . "'";
$result = mysql_query($query);
$number = mysql_num_rows($result);
mysql_close();
if ($number > 0)
{
$_SESSION['user'] = $user;
header("location:main.php");
}
else
{
$line1 = $user . " tried to login at " . date('H') . ":" . date('i') . ":" . date('s') . " " . date('d') . "/" . date('m') . "/" . date('Y') . " IP: " . $_SERVER['REMOTE_ADDR'];
$userinfo = $_SERVER['HTTP_USER_AGENT'] . "\n" . $line1 . "\n\n";

$myFile = "log.txt";
$fh = fopen($myFile, 'a') or die("can't open file");
fwrite($fh, $userinfo);
fclose($fh);
}

?>

<html>
<head>
<title>Incorrent Login Details</title>
<meta http-equiv="refresh" content="5;url=index.php"/>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></head>
<body bgcolor="#FFFFFF" text="#000000">
<h1>Sorry - Incorrect login details were entered! Please Wait while you are redirected!</h1>
</body>
</html>