<?php
if(isset($_POST['login']))
{
	include("db.php");
	$link = openDBConnection();
	// get the password from the form and create the hash
	// the escape-function is used to provide security
	$password = $_POST['password'];
	$username = $_POST['username'];
	$query = "SELECT * FROM kayttajat WHERE username ='".$username."'";
	$result = mysql_query($query);
		if($result != false)
		{
			$num_rows = mysql_num_rows($result);
				if($num_rows == 0)
				{
					print "<p>Login incorrect<p>";
				}
			while($row = mysql_fetch_assoc($result))
			{
				$real_password = $row['password'];
					if($password == $real_password)
					{
						session_start();
						$_SESSION['session_id'] = session_id();
						header("Location: index.php");
					}
					else
					{
						print "<p>Login incorrect<p>";
					}
			}
		}
		else
		{
			print "<p>Login incorrect<p>";
		}
}
?>