[SOLVED] checking if the user exists

[almightyegg]

on the index page there is a login form. I have tried to make it so when the clicks login, the ajax takes the users inputted info (email and password) and takes it to acces.php. In access.php I run a search for the user, if it equals 1 it redirects to welcome.php, if it doesn't equal one I want it to stay on index and send out an alert. Here is what I have so far:

Index.php

<input type="text" name="email" value="email"><br><br>
<input type="password" name="password" value="password">
<input type="button" value="LoGiN" id="sendButton" Onclick="sendRequest()">

 

Ajax.js

function createXMLHttp() {
if (typeof XMLHttpRequest != 'undefined')
	return new XMLHttpRequest();
else if (window.ActiveXObject) {
	var avers = ["Microsoft.XmlHttp", "MSXML2.XmlHttp",
	"MSXML2.XmlHttp.3.0", "MSXML2.XmlHttp.4.0",
	"MSXML2.XmlHttp.5.0"];
	for (var i = avers.length -1; i >= 0; i--) {
		try {
			httpObj = new ActiveXObject(avers[i]);
			return httpObj;
		} catch(e) {}
	}
}
throw new Error('XMLHttp (AJAX) not supported');
}
var request = createXMLHttp();

function gup(strParamName){
var strReturn = "";
var strHref = window.location.href;
if ( strHref.indexOf("?") > -1 ){
    var strQueryString = strHref.substr(strHref.indexOf("?")).toLowerCase();
    var aQueryString = strQueryString.split("&");
    for ( var iParam = 0; iParam < aQueryString.length; iParam++ )
    {
		if (aQueryString[iParam].indexOf(strParamName + "=") > -1 )
		{
			var aParam = aQueryString[iParam].split("=");
			strReturn = aParam[1];
			break;
		}
    }
}
return strReturn;
} 		

function sendRequest(request, url) {
    request.open("GET", url + '&GUINum=' + Math.floor(Math.random()*99999999999999999), true);
// The math random is for IE to not cache it
request.onreadystatechange = finishUpdate;
    request.send(null);
}
	var email = gup('email');
	var password = gup('password');
	var url = "access.php?email=" + email + "&" + "password=" + password;	
	sendRequest(request, url);


function finishUpdate() {
if (request.readyState == 4) {
	if (request.status == 200) {
		//do whatever when PHP script is done
		//perhaps refresh the page
		//or change the text on the page. whatever you want
	}
}
}

 

Access.php

<?
include 'db.php';

$email = $_GET['email'];
$password = $_GET['password'];

$sql = mysql_query("SELECT * FROM users WHERE email = '$email' AND password = '$password'");
$mysql = mysql_num_rows($sql);

if($mysql == 1){
setcookie(email, $email, time()+3600*24, '/', '.lordoftheabyss.com');
setcookie(password, $password, time()+3600*24, '/', '.lordoftheabyss.com');
header("Location: welcome.php");
}else{
//send error
}
?>