<?php
if (isset($_POST['submit'])) {
    include 'config.php';
    $theusername = $_POST['username'];
    $epassword = $_POST['password'];

    $getsalt = mysql_query("SELECT * FROM user where username = '$theusername' ") or die("خطأ في الإتصال");
    $tggt = mysql_fetch_array($getsalt);
    $salt = $tggt['salt'];
    $thepassword = md5(md5($epassword) . $salt);

    $result = mysql_query("SELECT * FROM user where username = '$theusername' AND password='$thepassword' ");
    if (mysql_num_rows($result) == 0) {
        echo 'there is wrnog';
    } else {

        while ($login_row = mysql_fetch_assoc($result)) {
            $usrnm = $login_row['username'];
            $passr = $login_row['password'];
            $ugroup = $login_row['usergroupid'];

            echo"Thanks ";
            // this sets variables in the session  
            session_start();
            $_SESSION['user_name'] = $usrnm;
            $_SESSION['user_password'] = $passr;
            $_SESSION['user_group'] = $ugroup;
            #header("refresh:2;url=admin.php");
            
        }
    }
} else {
    ?> <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST"> <input type="text" name="username"> <input type="password" name="password"> <input type="submit" name="submit"> </form> <?php
}
?>