php

There is a login page (login.php) that is coded html form (includes username and password textboxes). The implementation of login page (php-mysql) is shown below:

//php code begins
if (!isset($_SESSION)) {
session_start();
}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
   $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['username'])) {  //from form username textbox
   $loginUsername=$_POST['username'];
   $password=$_POST['password'];
   $MM_fldUserAuthorization = "access_level"; // from db user access-level
   $MM_redirectLoginSuccess = "login_success_page.php";
   $MM_redirectLoginFailed = "login_failed_page.php";
   $MM_redirecttoReferrer = false;
   mysql_select_db($DB_NAME, $DB_LINK);

   $Login_query=sprintf("SELECT username,password, access_level FROM tbl_user WHERE username=%s AND password=%s",
   GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text"));

   $Login = mysql_query($Login_query, $DB_LINK) or die(mysql_error());
   $loginFoundUser = mysql_num_rows($Login);
   
   if ($loginFoundUser) {

      $loginStrGroup  = mysql_result($Login,0,'access_level');

      if (PHP_VERSION >= 5.1) {session_regenerate_id(true);} else {session_regenerate_id();}
      //declare two session variables and assign them
      $_SESSION['MM_Username'] = $loginUsername;
      $_SESSION['MM_UserGroup'] = $loginStrGroup;

      if (isset($_SESSION['PrevUrl']) && false) {
         $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];
      }
      header("Location: " . $MM_redirectLoginSuccess );
   }
   else {
      header("Location: ". $MM_redirectLoginFailed );
   }
}
//php code ends