<?php
if (isset($_POST['submit'])) {
    include '../admin/config.php';
    $theusername = mysql_real_escape_string($_POST['username']);
    $epassword = mysql_real_escape_string($_POST['password']);

    $getsalt = mysql_query("SELECT * FROM user where username = '$theusername' ") or die("خطأ في الإتصال");
    $tggt = mysql_fetch_array($getsalt);
    $salt = $tggt['salt'];
    $thepassword = md5(md5($epassword) . $salt);

    $result = mysql_query("SELECT * FROM user where username = '$theusername' AND password='$thepassword' AND (usergroupid='5' OR usergroupid='6' OR usergroupid='7' OR usergroupid='17') ");
    if (mysql_num_rows($result) == 0) {

        echo '<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />';
        echo '<p align="center"><font color="#FF0000">
<span style="font-size: 50pt; font-weight: 700">عفوا</span></font></p>
<p align="center"><font color="#000080" size="5">البيانات المدخلة غير صحيحة</font></p>
';
        header("refresh:3;url=login.php");
    } else {

        while ($login_row = mysql_fetch_assoc($result)) {
            $usrnm = $login_row['username'];
            $passr = $login_row['password'];
            $ugroup = $login_row['usergroupid'];

            echo '<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />';
            echo'<p align="center"><font color="#FF0000">
                <span style="font-weight: 700; font-size: 50pt">أهلاً وسهلاً بكـ</span></font></p>
                <p align="center"><font size="5" color="#000080">.$usrnm.</font></p>
                ';
            // this sets variables in the session  
            session_start();
            $_SESSION['user_name'] = $usrnm;
            $_SESSION['user_password'] = $passr;
            $_SESSION['user_group'] = $ugroup;
            header("refresh:3;url=main.php");
        }
    }
} else {
    ?> 

    <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST">
        <table border="1" cellpadding="0" cellspacing="0" style="border-collapse: collapse; border-width: 0" bordercolor="#111111" width="100%">
            <tr>
                <td width="100%" align="center" style="border-style: none; border-width: medium">
                    <img border="0" src="img/login.jpg" width="423" height="284"></td>
            </tr>
            <tr>
                <td width="100%" align="center" style="border-style: none; border-width: medium">
                    <span lang="ar-sa">اسم المستخدم</span></td>
            </tr>
            <tr>
                <td width="100%" align="center" style="border-style: none; border-width: medium">
                    <input type="text" name="username" size="20"></td>
            </tr>
            <tr>
                <td width="100%" align="center" style="border-style: none; border-width: medium">
                    <span lang="ar-sa">الرقم السري</span></td>
            </tr>
            <tr>
                <td width="100%" align="center" style="border-style: none; border-width: medium">
                    <input type="password" name="password" size="20"></td>
            </tr>
        </table>
        <p align="center">&nbsp;
            <input type="submit" name="submit" value="تسجيل الدخول"> </p>
    </form>



    <?php
}
?>

<?php

$host = "www.webname.com";
$username = "data_username";
$password = "1111111";
$database = "data_pass";

mysql_connect($host, $username, $password) or die(mysql_errno());
mysql_select_db($database) or die(mysql_errno());

?>