<?
session_start();
include 'dbconnect.php';
$username = $_POST['uname'];
$password = md5(md5( md5($_POST['pword'])));
if ($password){
$sql = $dbh->prepare("select uname from contactslogin where uname =? and pword = ?");
$sql->bindParam(1,$username,PDO::PARAM_STR,20);
$sql->bindParam(2,$password,PDO::PARAM_STR,20);
$sql->execute();

$match = 0;
while ($row = $sql->fetch()){
$match++;	
}
if ($match > 0) {
$_SESSION['approved'] = 'yes';
header("Location: bestpractice.php");
}
}
 ?>

<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>Untitled Document</title>
</head>
<body>
<form action = "login.php" method = "post">
Username <input type = "text" name="uname" /><br/>
Password <input type = "text" name="pword" /><br/>
<input type = "submit" name = "submit" value = "Submit"/>
</form>
</body>
</html>