<?php

include 'extras/functions.php';

if (loggedin())
{
   header ("Location: index.php?p=userarea");
   exit();
}
if(isset($_POST['login']))   // checks to see if submit is true using login
{
  //get data into variables
  $username = $_POST['username'];
  $password = $_POST['password'];
  $rememberme = isset($_POST['rememberme']);

if ($username&&$password)
{

   $login = mysql_query ("SELECT * FROM users WHERE username = '$username'"); //loop checking of password and username for protection
   while ($row = mysql_fetch_assoc($login))
   {
         $db_password = $row['password'];
         if ($password ==$db_password)    //md5 add here
            $loginok = TRUE;
         else                  //bullon data type true or false 0,1
            $loginok = FALSE;

         if($loginok ==TRUE)
         {

           if($rememberme=="on")
              setcookie("username",$username, time()+7200);
           else if ($rememberme=="")
              $_SESSION['username']=$username;

           header("location: index.php?p=userarea");
           exit(); //some browsers dont accept header scripts

         }
         else
             die("Incorrect username / password");
   }
}
else
     die("Please enter a username and password");

}
?>