<?php
session_start();
include('db.php');

if(isset($_POST['submit'])) :
	// Username and password sent from signup form
	// Remove all HTML-tags and PHP-tags
	$username = strip_tags($_POST['username']);
	$password = strip_tags($_POST['password']);

	// Make the query a wee-bit safer
	$query = sprintf("SELECT ID FROM users WHERE username = '%s' AND user_password = '%s' LIMIT 1;", mysql_real_escape_string($username), mysql_real_escape_string($password));
	
	$result = mysql_query($query);
	if(1 != mysql_num_rows($result)) :
	// MySQL returned zero rows (or there's something wrong with the query)

		echo "<script>alert('Wrong login or password')</script>"; 
		header('Location: index.php');
	else :
		// We found the row that we were looking for
		$row = mysql_fetch_assoc($result);
		
		// Register the user ID for further use
		$_SESSION['member_ID'] = $row['ID'];
		header('Location: members-only.php');
	endif;
endif;
?>

window.location = 'index.php';