<?include "conninfo.php";

$username=$_POST["username"];
$password=$_POST["password"];


//$password=str_replace("1=1","",$password);
//$password=str_replace("'","&apos;",$password);
 
$query="SELECT * FROM people 
WHERE (username like '$username') 
AND (password like '$password')";

//echo $query;


$result=mysql_query($query);?>
<br><br><br><br>

<?$numrows=mysql_num_rows($result);

if ($numrows>0){?>
<b>Thank you for logging in. Here are your details:<br><br>
<?

    while ($r=mysql_fetch_array($result))
    {
    echo $r["id"]." ";
    echo $r["firstname"]." ";
    echo $r["surname"]." ";
    echo $r["address"]."<br>";
    }
}
else
{
echo "Sorry, no records found";
}




$username=str_replace("'"," ",$username); //strip out single quote
$password=str_replace("'"," ",$password); //strip out single quote?>
