require "config.php"; if ($_POST['action'] == "login") { $em = mysql_real_escape_string($_POST['email']); $pw = mysql_real_escape_string($_POST['password']); $hash = md5(md5($pw)); $r1 = mysql_query("SELECT id FROM tw_users WHERE email=\"$em\" AND password=\"$hash\""); list ($uid) = mysql_fetch_row($r1); if ($uid > 0) { $_SESSION['email'] = $em; $_SESSION['id'] = $uid; header("Location: index.php"); exit; } else { $msg = "Incorrect username or password. We don't have a mechanism for recovering lost passwords, so looks like you're screwed"; } } ?>