<?php

	$sql = 'SELECT * FROM User WHERE userEMail = "'.$_POST['EMail'].'";';
	$result = $db->query($sql);
	$nt = $result->fetch_assoc();
	if (!$nt)
		{
			echo "<p>EMail-Adresse existiert nicht!</p>";
			include "inhalte/login2.php";
		}
	elseif ( 'Y' == $nt['userDeact'] )
		{
			echo "<p>Ihr Account wurde deaktiviert!</p>";
			echo "<p>Bitte wenden Sie sich an den Administrator!</p>";
		}
	else
		{
			if ( md5 ( $nt['userPassword'] ) == md5 ( $_POST['Passwort'] ) )
				{
					$_SESSION['ID'] = session_id();
					$_SESSION['TID'] = $nt['userId'];
					if ( 'Y' == $nt['userIsAdmin'] )
						{
							$_SESSION['IsAdmin'] = 1;
							$_SESSION['IsBuero'] = 1;
							?>
								<script type="text/javascript">
									<!--
									window.location = "index.php?section=home"
									//-->
								</script>
							<?php
						}
					else
						{
							$_SESSION['IsAdmin'] = 0;
							if ( 'Y' == $nt['userIsBuero'] )
								{
									$_SESSION['IsBuero'] = 1;
									?>
										<script type="text/javascript">
											<!--
											window.location = "index.php?section=suche"
											//-->
										</script>
									<?php
								}
							else
								{
									$_SESSION['IsBuero'] = 0;
									?>
										<script type="text/javascript">
											<!--
											window.location = "index.php?section=objekte"
											//-->
										</script>
									<?php
								}
						}
				
				}
			else
				{
					echo "Passwort und EMail-Adresse stimmen nicht überein!";
					include "inhalte/login2.php";
				}
		}
?>