<form method="post" action="cek_login.php" id="lg-form" name="lg-form" > 

 <p><strong>Username</strong></p> 

 <input name="username" id="username1" type="text" placeholder="Username" />

 </p>

 <p><strong>Password</strong></p>

 <p><input name="password" id="password1" type="password" placeholder="Password" /></p>

 <p align="center"><button type="submit" id="login">Login</button></p> 

 </form>

<?php

include('config.php');

 

session_start();

 

//tangkap data dari form login

$username = $_POST['username'];

$password = $_POST['password'];

$password = md5($password);



 

//untuk mencegah sql injection

//kita gunakan mysql_real_escape_string

$username = mysql_real_escape_string($username);

$password = mysql_real_escape_string($password);

 

$q = mysql_query("SELECT * FROM user WHERE username='$username' ");

if (mysql_num_rows($q) == 1) {

 //kalau username dan password sudah terdaftar di database

 $_SESSION['id_member'] = $id_member;

 $_SESSION['username'] = $username;

 $_SESSION['password'] = $password;

 $_SESSION['telp'] = $telp;

 $_SESSION['alamat'] = $alamat;



 header('location:indexuser.php');

} else {

 //kalau username ataupun password tidak terdaftar di database

 header('location:login_user.php?message=gagal');

}



?>