Untitled

<?php
	ob_start();
	session_start();
?>
<html>
<body>
<?php
	if(!isset($_SESSION['ID']))
	{
		echo('<form action="logintest.php" method="post">');
		echo('Username:<input type="text" name="user" /><br />');
		echo('Password:<input type="password" name="pass" /><br /><input type="Submit" value="Login" /></form><br />');

	}
?>
<?php
	$user=$_POST["user"];
	$pass=$_POST["pass"];
	$con=mysql_connect("localhost","root");
	if(!$con)
	{
		die('Could not Connect:'.mysql_error());
	}
	mysql_select_db("cms", $con);
	$result = mysql_query("SELECT Password FROM login WHERE Username = '$user'") or die('No such user');
	$row=mysql_fetch_assoc($result);
	$passtest=$row["Password"];
	if($row==false)
	{
		echo("Wrong password<br />");
	}
	else if($row==true)
	{
	if($pass!=$passtest)
	{
		echo("Wrong password and/or username");
	}
	else if($pass==$passtest)
	{
		$login=true;
		echo("Logged In successfully");
		$query = mysql_query("SELECT * from login WHERE Username = '$user'") or die(mysql_error);
		$row = mysql_fetch_assoc($query);
		$status = $row["Status"];
		if($status==1)
		{
			echo("<br />You are admin");
			$_SESSION['ID']=1;

		}
		else
		{
			echo("<br />You are not admin.");
			echo("<a href='noruser.php'>Proceed</a>");
			$_SESSION['ID']=0;
		}
		}
		else
		{
			echo("Wrong password");
		}
	}

	mysql_close($con);
	if(isset($_SESSION['ID'])
	{
		ob_end_clean();
		if($_SESSION['ID']==1)
		{
			$header("Location:admin.php");
			exit;
		}
		else
		{
			header("Location:noruser.php");
			exit;
		}


	}
	echo("<br /><br /><br /><br />");
	?>
</body>
</html>