<?
include ('./includes/header.php');
// Check if the form has been submitted.
if (isset($_POST['submitted'])) {
require_once('../sqlconnect/connect.php');
 
$errors = array(); // Initialize error array.
// Check for an email address.
if (empty($_POST['email'])) {
$errors[] = 'You forgot to enter your email address.';
} else {
$em = trim($_POST['email']);
}
// Check for a password.
if (empty($_POST['pass'])) {
$errors[] = 'You forgot to enter your password.';
} else {
$pw = trim($_POST['pass']);
}
if (empty($errors)) { // If everything's OK.
 
$query = "SELECT * FROM members WHERE email = '$em' AND password = SHA('$pw')";
 
$result = @mysql_query($query);
// Run the query.
$row = mysql_fetch_array ($result, MYSQL_NUM);
 
// Return a record, if applicable.
if ($row){ // A record was pulled from the database.
 
//set session
session_name('visit');
session_start();
$_SESSION ['id'] = $row[0];
$_SESSION ['name'] = $row[1];
$_SESSION ['email'] = $row[3];
$_SESSION ['agent'] = md5($_SERVER['HTTP_USER_AGENT']);
 
// Redirect the user to the loggedin.php page.
// Start defining the URL.
$url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']);
// Check for a trailing slash.
if ((substr($url, -1) == '/') OR (substr($url, -1) == '\\') ) {
$url = substr ($url, 0, -1); // Chop off the slash.
}
// Add the page.
$url .= '/loggedin.php?' . $_SESSION['agent'];
 
header("Location: $url");
exit();
// Quit the script.
} else { // No record matched the query.
$errors[] = 'The email address and password entered do not match those on file.'; // Public message.
$errors[] = mysql_error() . '<br />Query: ' . $query; // Debugging message.
}
 
} // End of if (empty($errors)) IF.
 
mysql_close(); // Close the database connection.
 
} else { // Form has not been submitted.
 
$errors = NULL;
 
} // End of the main Submit conditional.
 
//print errors
if (!empty($errors)){
 
echo '<h1 id = mainhead>Error!</h1>
<p class = error >Following occured:<br/>';
 
foreach ($errors as $msg){
echo " - $msg<br/>\n";
}
echo '<p>Please try again <a href = login.php>Reset</a>';
}
?>

$errors[] = mysql_error() . '<br />Query: ' . $query; // Debugging

ini_set("display_errors", 1);
ini_set('error_reporting',E_ALL);

ini_set("display_errors", 1);
ini_set('error_reporting',E_ALL);

echo $query;
die;

SELECT * FROM members WHERE email = 'test@test.com' AND password = SHA('test')

echo $query;
or die;