<?php

if(!isset($_SESSION['logged_in']) || empty($_SESSION['logged_in']))
{
    // If user is not authenticated redirect to authentication page
    if (!$_SESSION['logged_in'])
        header("Location: localhost/login.htm");
}

 $user = addslashes($_POST['username']);
 $pass = md5($_POST['password']);

 //set the database connection variables

 $dbHost = "localhost";
 $dbUser = "webuser";
 $dbPass = "";
 $dbDatabase = "mydatabase";

 // connect to the database

 $db = mysql_connect($dbHost, $dbUser, $dbPass) or die("Error connecting to database.");

 mysql_select_db($dbDatabase, $db) or die("Coudln't select the databse.");

 $result=mysql_query("SELECT * FROM users WHERE userName='$user' AND userPass='$pass'", $db);

 $rowCheck = mysql_num_rows($result);

 if ($rowCheck > 0){
  while($row = mysql_fetch_array($result)){

   // Start the session
   session_start();

   // Set the session variables
   $_SESSION['username'] = $row['user'];
   $_SESSION['logged_in'] = true;

   // Successful login code will go here...
   echo'Success!';

  // We will redirect the user to another page where we will make sure they're logged in.
   // header("Location: checkLogin.php"); | No need for this
  }
 }
 else
 {
   // if nothing is returned by the query, unsuccessful login code goes here.

   echo 'Incorrect login name or password. Please Try again.';

}
?>