login.php at Simple Accounting System

<?php 
session_start();
ob_start(); 
?><html>
<head>
<link rel="stylesheet" type="text/css" href="lib.global.css"/>
<style>
	.message{border:2px solid #999999;padding:10px;}
</style>
<script>
function validateEntries() 
{
	
	var reg = /[a-zA-Z]{1}[a-zA-Z0-9]{5,19}$/
	var str = document.getElementById("username").value;
	if (!(str.match(reg)))
	{
		document.getElementById("message").innerHTML = "Not a valid username. Please enter alpha numeric minimum of 6 characters and maximum of 20 characters and should start with alphabet.";
		return false;	
	}
	
	var reg = /^[A-Za-z]\w{6,}$/;
	var str = document.getElementById("pass").value;
	if (!(str.match(reg)))
	{
		document.getElementById("message").innerHTML = "Please enter a valid password!";
		return false;	
	}	
	return true;
}
</script>

</head>
<body>
<div id="maincontainer">
<?php
include_once 'lib.dbconnect.php';
include_once "header.php";		
if ($_GET['create'] == 'success'){
	$message = "User Account was successfully created. You can login Now.";
}
?>
<div id="contentwrapper">
	<div id="contentcolumn">
	<div class="innertube">
<?php
//if the login form is submitted
if (isset($_POST['submit'])) 
{ 
	// if form has been submitted
	// makes sure they filled it in
	if(!$_POST['username'] | !$_POST['pass']) {
		$message ='You did not fill in a required field.';
	}
	// checks it against the database
	if (!get_magic_quotes_gpc()) {
		$_POST['username'] = addslashes($_POST['username']);
	}
	$check = mysql_query("SELECT * FROM users WHERE username = '".$_POST['username']."'")or die(mysql_error());
	//Gives error if user dosen't exist
	$check2 = mysql_num_rows($check);
	if ($check2 == 0) {
		$message = 'Incorrect username or password';
	}
	while($info = mysql_fetch_array( $check ))
	{
		$_POST['pass'] = stripslashes($_POST['pass']);
		$info['password'] = stripslashes($info['password']);
		$_POST['pass'] = md5($_POST['pass']);
		//gives error if the password is wrong
		if ($_POST['pass'] != $info['password']) {
			$message = 'Incorrect password, please try again.';
		} else {
			// if login is ok then we add a cookie
			$_POST['username'] = stripslashes($_POST['username']);
			$hour = time() + 86400;
			setcookie(username, $_POST['username'], $hour);
			setcookie(userkey, $_POST['pass'], $hour);
			setcookie(cname, $_POST['cname'], $hour);			
			//then redirect them to the members area
			
			//$_SESSION['database'] = $_POST['username'];
			header("Location: index.php");
		}
	}
}?>

<style>
body {color:#2F2F2F}
.fieldsetform {border:1px solid #B4B4B4;margin:0 0 15px;padding:15px;}
.rowform {padding: 8px 0;}
.rowform label {float:left;font-weight:bold;text-align:right;width:175px;padding:0px 5px;}
</style>

	Using it for the first time. <a href="registration.php">Click here to sign up.</a>
	<form action="<?php echo $_SERVER['PHP_SELF']?>" method="post">
	
	<fieldset class="fieldsetform">
	
	<legend>Login</legend>
	<div class="rowform">
        <label>* Username</label>
        <input type="text" name="username" id="username" maxlength="20">
    </div>	
	<div class="rowform">
        <label>* Password</label>
        <input type="password" name="pass" id="pass" maxlength="50">
    </div>
	<div class="rowform">
		<label>&nbsp;</label>
        <input type="submit" name="submit" value="Login" onclick="javascript:return validateEntries()">
    </div>
	</fieldset>
	
	</form>
	<div id="message"><?php echo $message ?></div>
		<div id="message"></div>
	</div>
</div>
</div>
	
<div id="leftcolumn">
	<div class="innertube">
		<b>	<a href="registration.php">New User Sign Up</a><em></em></b>
	</div>
	<div class="innertube_high">
		<b><a href="login">Login</a></b>
	</div>
</div>


<?php include_once 'footer.php' ?>
</div> 
<!-- End of Main Container -->
</html>
<?php ob_end_flush() ?>