<?php 
$username = $_POST['username']; //from an different page 
$password = $_POST['password']; //from an different page 
 
# Oh-oh!! 
$sql = "SELECT * FROM users WHERE username='$username' and password='$password'"; 
$result = mysql_query($sql); 
$count = mysql_num_rows($result); 
 
if($count==1) { echo "Success"; } 
else { echo "Wrong!"; } 
?> 

<?php 
$username = $_POST['username']; //from an different page 
$password = $_POST['password']; //from an different page 
 
# Oh-oh!! 
$sql = "SELECT * FROM users WHERE username='" . mysql_real_escape_string($username) . "' and password='" . mysql_real_escape_string($password) . "'"; 
$result = mysql_query($sql); 
$count = mysql_num_rows($result); 
 
if($count==1) { echo "Success"; } 
else { echo "Wrong!"; } 
?> 

<?php  
$conn = mysql_connect("localhost", "user", "pass");  
?> 

<?php 
mysql_real_escape_string($username, $conn); 
?> 

<?php 
//Escape Username $_POST string 
$user = mysql_real_escape_string($_POST['user']); 
//Escape and md5 encrypt Password $_POST string 
$password = md5(mysql_real_escape_string($_POST['password'])); 
  
checkDatabase(); 
  
//Write Query 
$query_string = "SELECT * 
FROM users 
WHERE name = ". $user ." 
AND password = ". $password 
 
//Count Results 
$count = mysql_num_rows(mysql_query($query_string) or die(mysql_error())); 
  
 if($count == 1) 
 { 
 session_start(); 
 $_SESSION['bowchika'] = 1; 
 echo "Success! You've been logged in!"; 
 } 
  
 else 
 { 
 echo "Darn, the user and password combination you defined do not match or do not exist. Please try again or register."; 
 } 
 ?> 

<?php 
session_start(); 
// Page Include 
function pageInclude() 
{ 
 
$page = $_GET['id']; 
if(!isset($page)) 
{ 
$file = "main.php"; 
} 
 
elseif(!file_exists($page . ".php")) 
{ 
$file = "404.php"; 
} 
 
else 
{ 
$file = $page . ".php"; 
} 
 
include($file); 
} 
 
 
//Database Connect 
function checkDatabase(){ 
mysql_connect("myhost", "myusername", "mypassword") or die(mysql_error()); 
 
mysql_select_db("mydatabasename") or die(mysql_error()); 
 
} 
 
 
//Check User 
function userCheck() 
{ 
if($_SESSION['bowchika'] == 1) 
{ 
echo "<strong>You're logged in,</strong> " . $_SESSION['bowchow'] . "! [<a href=\"?id=usercp\">User CP</a> . "; 
    if($_SESSION['dfusergroup'] == "admin") 
    { 
    echo "<a href=\"?id=admincp\">Admin CP</a> . "; 
    } 
echo "<a href=\"?id=logout\">Log Out</a>]"; 
} 
 
else 
{ 
echo "<strong>Hello,</strong> Visitor! [<a href=\"?id=login\">Login</a> . <a href=\"?id=register\">Register</a>]"; 
} 
 
} 
 
//Login User 
function login() 
{ 
$user = $_POST['user']; 
$password = $_POST['password']; 
mysql_real_escape_string($user); 
mysql_real_escape_string($password); 
 
$query = "SELECT * FROM users WHERE user='" . $user . "' and password='" . $password . "'"; 
$query2 = "SELECT usergroup FROM users WHERE user='" . $user . "' and password='" . $password . "'"; 
$result = mysql_query($query) or die(mysql_error()); 
$count = mysql_num_rows($result); 
 
if($count == 1) 
{ 
$result2 = mysql_query($query2) or die(mysql_error()); 
$hereWeGo = mysql_fetch_array($result2); 
$_SESSION['dfusergroup'] = $hereWeGo['usergroup']; 
$_SESSION['bowchow'] = $user; 
$_SESSION['bowchika'] = 1; 
echo "Success! You've been logged in! Click <a href=\"?id=main\">here</a> to go home."; 
} 
 
elseif($count != 1) 
{ 
echo "Darn, the user and password combination you defined do not match or do not exist. Please try again or register."; 
} 
} 
 
function logout() 
{ 
session_destroy(); 
} 
?> 

<form action="?id=usercheck" method="post"> 
<table> 
<tr> 
<td>Username:</td> 
<td><input type="text" name="user" /></td> 
</tr> 
<tr> 
<td>Password:</td> 
<td><input type="password" name="password" /></td> 
</tr> 
<tr> 
<td><input type="submit" value="Submit" /></td> 
<td><input type="reset" value="Reset"></td> 
</tr> 
</table> 
</form> 

function register() 
{ 
$query = "INSERT INTO users (user, password, usergroup, email, regdate)  
values('".$_POST['user']."', '".$_POST['password']."', 'user', '".$_POST['email']."', CURDATE()"; 
}