<?php
if(isset($_POST['submit_login']) && $user->data['user_id'] == ANONYMOUS)
{
    //form was submitted
    $username = $bvadb->real_escape_string($_POST['username']);
    $password = $bvadb->real_escape_string($_POST['password']);

    $q = "SELECT * FROM Users WHERE Username='{$username}' AND Pwd=MD5('{$password}') LIMIT 1";
    $result = $bvadb->Query($q);

    if(!$result->num_rows)
    {
        echo "";
        echo '
            <form action="?page=' . $page . '" method="post">
            Wrong username and/or password!
                <table border=0>
                    <tr><th>Username</th><td>:</td><td><input type="text" value="" name="username" /></td></tr>
                    <tr><th>Password</th><td>:</td><td><input type="password" name="password" /></td></tr>
                </table>
                <input type="submit" name="submit_login" value="Login" />
            </form>
        ';
    }
    else
    {
        // log the user in

        $old_session_id = $user->session_id;
        $user->session_create($row['FID'], 0, false, $viewonline = true);

        //echo "<meta http-equiv=\"refresh\" content=\"0;url=/website/?page={$page}\">";
    }
}
else
{
    if($user->data['user_id'] == ANONYMOUS)
    {
        echo '
            <form action="?page=' . $page . '" method="post">
                <table border=0>
                    <tr><th>Username</th><td>:</td><td><input type="text" value="" name="username" /></td></tr>
                    <tr><th>Password</th><td>:</td><td><input type="password" name="password" /></td></tr>
                </table>
                <input type="submit" name="submit_login" value="Login" />
            </form>
        ';
    }
    else
    {
        $q = "SELECT First_Name, Last_Name, VAID FROM Users WHERE FID={$user->data['user_id']} LIMIT 1";
        $result = $bvadb->Query($q);
        $row = $result->fetch_assoc();
        echo "<div id=\"loginsucces\">Welcome {$row['First_Name']} {$row['Last_Name']}<br />";
        if($row['VAID'] != -1){echo "{$row['VAID']}";}
        echo "</div>";
    }
}


?>