<?php
if (isset($_POST["submit"])) {
    include("../connect-rop.php");
    $message = NULL;
    if(empty($_POST["username"])) {
        $u = FALSE;
        $message .= "You have to enter your username !<br />";
    }
    else {
        $u = stripslashes(trim($_POST["username"]));
    }
    if(empty($_POST["password"])) {
        $p = FALSE;
        $message .= "You have to enter your password !<br />";
    }
    else {
        $p = stripslashes(trim($_POST["password"]));
    }
    if($u&&$p) {
        $query = "SELECT user_id, username FROM profile WHERE username = '$u' AND password = PASSWORD('$p')";
        $result = @mysql_query($query);
        $row = mysql_fetch_array($result);
        if($row){
            session_start();
            $username = $row["username"];
            $user_id = $row["user_id"];
            session_register(username, user_id);
            header("location : http://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF'])."/index.php");
            exit();
        }
        else {
            $message .= "Your username or password have been entered was wrong !<br />";
        }
    }
}    

$page_title = "Login";
include("template/header.php");
if(empty($message)) {
    echo "<font color=red>So sorry, this page is only for ROP members !</font>";
}
else {
    echo "<font color=red>";
    echo $message;
    echo "</font>";
}
?>
<fieldset><legend>Login</legend>
<table width="260" border="0">
<form action="<?php $_SERVER['PHP_SELF'] ?>" method="POST">
<tr><td><b>Username :</b></td> <td align="right"><input type="text" name="username" maxlength="30" value="<?php if(isset($_POST["username"])){echo $_POST["username"];}?>" /></td></tr>
<tr><td><b>Password :</b></td> <td align="right"><input type="password" name="password" maxlength="16"/></td></tr>
</table><br /><br />
<input type="submit" name="submit" value="Login"  /><input type="reset" value="Rewrite" />
</form>
</fieldset>
<?php
include("template/footer.php");
?>

$result = mysql_query($query) or die(mysql_error());

$query = "SELECT user_id, username FROM profile WHERE username = '$u' AND password = PASSWORD('$p')";

$query = "SELECT user_id, username FROM profile WHERE username = '$u' AND password = '$p'";

            session_start();
            $username = $row["username"];
            $user_id = $row["user_id"];
            session_register(username, user_id);