Untitled

<?php
$_SESSION[''] = '';
require("../css/mysql.php");
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
      <title>LogIn zum Adminbereich</title>
       <link rel="SHORTCUT ICON" href="gfx/favicon.ico">
        <link rel="stylesheet" type="text/css" href="/css/formatierung.css">

</head>
<body>
       <?php if(!isset($_POST['submit'])) { ?>
             <form action="<?php $PHP_SELF ?>" method="post">
              <table width="200" height="*" cellspacing="2" cellpadding="2" border="1" bordercolor="#ffffff">
               <tr>
                <th width="*" class="th" colspan="5">
                 <b>Log In</b>
                </th>
               </tr>
              <tr>
               <td width="*" bgcolor="#e7e7e7">Benutzer</td>
                <td width="*" bgcolor="#ffffff">
                 <input type="text" name="username" size="20" class="input"></td>
                 </td>
                </tr>
               <tr>
                <td width="*" bgcolor="#e7e7e7">Passwort</td>
                 <td width="*" bgcolor="#ffffff">
                 <input type="password" name="password" size="20" class="input"></td>
                </tr>
                <tr>
                 <td bgcolor="#e7e7e7" align="center" colspan="2">
                  <input type="submit" name="submit" value="Anmelden" class="button">
                 </td>
                </tr>
              </table>
             </form>
<?php
}elseif(!$_POST['username'] || $_POST['username'] == "") {
echo '<p align="center">Einen Benutzernamen brauchen wir schon ;-)<br /><br />
<a href="index.php">Zurück</a></p>';
}elseif(!$_POST['password'] || $_POST['password2'] == "") {
echo '<form action="index.php" method="post">';
echo '<p align="center">Ein Passwort brauchen wir schon ;-)<br /><br />';
echo '<input type="hidden" name="username" value="'.$_POST['username'].'">';
echo '<input type="submit" name="zurueck" value="Zurück">';
echo '</p>';
echo '</form>';
}else{
$password = md5($_POST['password']);
$query = @mysql_query("SELECT user, pass FROM users WHERE user = '".mysql_real_escape_string($_POST['username'])."'");
$result = @mysql_fetch_array($query) or die('<p align="center">
Sorry, aber dieser Benutzername existiert nicht!<br /><a
href="index.php">Zurück</a></p>');
if($password != $result['pass']){
echo '<form action="index.php" method="post">';
echo '<p align="center">Sorry, aber dieses Passwort ist falsch!<br /><br />';
echo '<input type="hidden" name="username" value="'.$_POST['username'].'">';
echo '<input type="submit" name="zurueck" value="Zurück"></p>';
echo '</form>';
die;
}else{
$user = $result['user'];
session_register('user');
echo '<p align="center">LogIn erfolgreich! :-)<br><br><a href="/in/index1.php" target="_top">Weiter</a></p>';
}
}
?>
</body>
</html>