<?php 

// Connect to the database
require('dbconnect.php'); 

// Set username and password variables for this script
$user = mysql_real_escape_string($_POST['username']);
$pass = mysql_real_escape_string($_POST['password']); 

// Make sure the username and password match, selecting all the client's
// data from the database if it does. Store the data into $clientdata
$clientdata = mysql_query("SELECT * FROM bm WHERE username='$user' and password='$pass'")
 or die (mysql_error());

// Put the $clientdata query into an array we can work with
$data = mysql_fetch_array($clientdata, MYSQL_ASSOC);

// If the username and password matched, we should have one entry in our
// $clientdata array. If not, we should have 0. So, we can use a simple
// if/else statement
if(mysql_num_rows($clientdata) == 1){
	// Start a new blank session. This will assign the user's server
	// with a session with an idividual ID
	session_start();

	// With our session started, we can assign variables for a logged
	// in user to use until they log out.
	$_SESSION['username'] = $user;
	$_SESSION['fname'] = $data['fname'];
	$_SESSION['sname'] = $data['sname'];
	
	// Then, redirect them to the profile page
	header('Location: index.php');
}else{echo "Invalid Username and Password. Please go back and try again.
            (.)";}
			
?>
<a href="index.html">Click here to continue
</a>