<?php
	$userid = $_REQUEST['userid'];
	$password = $_REQUEST['password'];

	include "../connect/db_connection.php";
		
	$query = "SELECT * FROM users WHERE `UserID` = '$userid'";
	$result = mysql_query($query, $bwb_link);
	$row = mysql_fetch_array($result);
	$num_results = mysql_num_rows($result);
	
	if ($num_results < 1)
	{
		echo "There is no user by that name.   Click <a href='index.php'> here </a> to re-enter your user ID and password.";
		exit;
	}
		
	$access_level = $row["AccessLevel"];
	
	/////////////////////////////////////////////
	//Decrypt for comparison:
	$enc_text = stripslashes($row["password"]);
	$key = stripslashes($row["UserID"]);
	
	//Convert key to codes and pad as necessary.
	for( $i = 0; $i < (strlen($enc_text))/2; $i++)
	{
		if ($i < strlen($key))
		{
			$c = $key{$i};
			$k[$i] = ord($c);
		}
		else
			$k[$i] = 65 + $i;
	}
	
	//Convert encrypted string to array of HEX uni-character codes.
	$j = 0;
	$q = 0;
	for( $i = 0; $i < strlen($enc_text); $i++)
	{
		if ($j == 0) {
			$c = $enc_text{$i};
			$j++;
		}
		else {
			$c = $c.$enc_text{$i};
			$e[$q] = hexdec($c);
			$q++;
			$j = 0;
		}
		
	}
	
	//Decrypt encrypted string with key to get original data.
	$decrypt_text = "";
	for( $i = 0; $i < (strlen($enc_text))/2; $i++)
   	{
   		$a[$i] = $e[$i] ^ $k[$i];
		$decrypt_text = $decrypt_text. chr($a[$i]);
   	}
	////////////////////////////////////////////////////
	
	$password_lookup = $decrypt_text;
	if ($password_lookup == $password)
	{
		session_start();
		$_SESSION['access_level'] = $access_level;
		$_SESSION['logged_in'] = 10;
		if ($access_level == "admin")
			$_SESSION['view_id'] = 1;	// 1 = mananager
		elseif ($access_level == "user")
			$_SESSION['view_id'] = 2;	// 2 = associate
		elseif ($access_level == "reseller")
			$_SESSION['view_id'] = 3;	// 3 = reseller
		header("Location: manage_inventory.php");
	}
	else
		echo "Your password has not been confirmed.   Click <a href='index.php'> here </a> to re-enter your password.";
	
?>
