Untitled

<?php
session_start();
$error_msg = "";

//retrieve form data
$email = $_POST['email'];
$password = $_POST['password'];

//connect to database
$DBHOST = 'localhost';
$DBUSERNAME = 'root';
$DBPASSWORD = '';
$DB = 'jobx';

$link = mysqli_connect($DBHOST,$DBUSERNAME,$DBPASSWORD,$DB);

//match the username and password entered with database record
$query = 'SELECT * FROM `xuser` WHERE `email` = "' . $email . '" AND `password` = SHA1("' . $password . '")';
$result = mysqli_query($link,$query) or die(mysqli_error($link));

//if record is found, store id and name into session
if(mysqli_num_rows($result) >0){
$row = mysqli_fetch_array($result);
$_SESSION['role_id'] = $row['role_id'];
$_SESSION['email'] = $row['email'];
$_SESSION['logged_in'] = true;
$_SESSION['user_info'] = $row['name'];
switch($_SESSION['role_id'])
{
case 1:
header("location: index.html");
break;
case 2:
header("location: index2.html");
break;
default:
header("location: index3.html");
break;
}
}
else{ //record not found
echo '<p class="error">Sorry, you must enter a valid email and password to log in.<a href="login.php">Back</a></p>';
}
}

?>
<html>
<head>
<title>member Log-in</title>
</head>

<body>
<center>
<form action="login.php" method="POST">
<table border="0" background = "white.png" width= 800 height= 600>
<tr>
<td>
<center>
<center>Email <input type="text" name="email" /><br />
<center>Password <input type="password" name="password" /><br /><br />
<center><input type="submit" name="login" value="Log In" /><br />

<center><a href='index.html'>Back to Home</a><br>
</form>
</body>

</html>