<?php

session_start();

$path_to_root = "";
include $path_to_root . 'database.php';

$db = new database();

$email = strip_tags(trim($_POST['email']));
$pass = strip_tags(trim($_POST['password']));

$sql = get_sql_login_page($email, $pass);

$result = $db->db_query($sql);
$num_rows = $db->db_num_rows($result);

if ($num_rows > 0) {
	$rows = $db -> db_fetch_array($result);

	unset($_POST);
	$_SESSION['user_id'] = $rows['user_id'];
	$_SESSION['user_email'] = $rows['email'];
	$_SESSION['user_level'] = $rows['level'];

	if ($rows['level'] == 2) {
		header("location:index.php");
	} else if ($rows['level'] == 1) {
		header("location:admin/index.php");
	}
} else {
	header("location:login.php?login=1");
}

function get_sql_login_page($email, $pass){
    $sql = "SELECT * FROM users"
        . " WHERE email = '" . $email . "' AND password = MD5('" . $pass . "')";
        echo $sql;
    return $sql;
}

?>