<?php
session_start();

if(isset($_SESSION['user']))
{
echo '<meta http-equiv="refresh" content="0;URL=index.php">'; 
exit;
}

$username = $_POST['username'];
$password = $_POST['password'];

if(empty($username) or empty($password))
{
$sm = 'Please fill username and password';
echo '<meta http-equiv="refresh" content="0;URL=login.php?sm='.$sm.'">'; 
exit;
}

include('../db.php');

$q = "select * from user where username='$username' and password='$password'";
$res = mysqli_query($dbcon,$q) or die(mysqli_error($dbcon));
if(mysqli_num_rows($res)<1)
{
$sm = 'Username and password do not match';
echo '<meta http-equiv="refresh" content="0;URL=login.php?sm='.$sm.'">';
exit; 
}

$row = mysqli_fetch_array($res);
if($username == $row['username'] and $password == $row['password'])
{
$_SESSION['user'] = $username;
echo '<meta http-equiv="refresh" content="0;URL=index.php">'; 
//echo "username: ".$username." password: ".$password;
}
else
{
$sm = 'Check username and password and try again'.$username.', '.$password;
echo '<meta http-equiv="refresh" content="0;URL=login.php?sm='.$sm.'">';
exit; 
}

?>