$username = $_COOKIE['Username'];
$pass = $_COOKIE['Password'];
$check = mysql_query("SELECT * FROM user WHERE username = '$username'")or die(mysql_error());
while($info = mysql_fetch_array( $check ))
{
if ($pass != $info['password'])
{
}
else
{
header("Location: members.php");

}
}
}

//if the login form is submitted
if (isset($_POST['submit'])) { // if form has been submitted

// makes sure they filled it in
if(!$_POST['username'] | !$_POST['pass']) {
die('You did not fill in a required field.');
}
// checks it against the database

if (!get_magic_quotes_gpc()) {
$_POST['email'] = addslashes($_POST['email']);
}
$check = mysql_query("SELECT * FROM user WHERE username = '".$_POST['username']."'")or die(mysql_error());

//Gives error if user dosen't exist
$check2 = mysql_num_rows($check);
if ($check2 == 0) {
die('That user does not exist in our database. <a href=add.php>Click Here to Register</a>');
}
while($info = mysql_fetch_array( $check ))
{
$_POST['pass'] = stripslashes($_POST['pass']);
$info['password'] = stripslashes($info['password']);
$_POST['pass'] = md5($_POST['pass']);

//gives error if the password is wrong
if ($_POST['pass'] != $info['password']) {
die('Incorrect password, please try again.');

$username = $_COOKIE["Username"];
$pass = $_COOKIE["Password"];
// Connect to the database
mysql_connect("server","username","password") or die("Error: ".mysql_error());
// Select database table
mysql_select_db("database");
// Check if user exists
// Suggestion: Don't go through this if there is no username/password
if($username != "" && $password != ""){
             $check = mysql_query("SELECT * FROM `user` WHERE `username` = '$username'") or die("Error: ".mysql_error());
             While ($info = mysql_fetch_array($check)){
                   if($pass != $info["password"]){
                            // Invalid Password
                   }else{
                         header("Location: members.php");
                   }
             }
}else{

      // If form is submitted
      if (isset($_POST["submit"])){
         if ($_POST["username"] == "" || $_POST["pass"] == ""){
          die("You did not fill in a required field.');
          // Suggestion: Just for clarity put the rest of the page in the else statement
         }else{
               if(!get_magic_quotes_gbc()){
                                           $_POST["email"] = addslashes($_POST["email"]);
               }
               // Suggestion: Don't put post in mysql feed it into a variable
               $user = $_POST["username"];
               $check = mysql_query("SELECT * FROM `user` WHERE `username` = '$user'") or die("Error: ".mysql_error());
               $check2 = mysql_num_rows($check);
               if($check2 == "0"){
                    die("That user does not exist in our database. <a href=\"add.php\">Click Here to Register</a>");
               }else{
                     // Suggestion: Put loop in else statement
                     While ($info = mysql_fetch_array($check)){
                           // Suggestion: Cut straight to the chase, just md5
                           $_POST["pass"] = MD5($_POST["Pass"]);
                           if($_POST["pass"] != $info["password"]){
                                       die("Incorrect password, please try again");
                           }else{
                                      // Valid login
                           }
                     }
               }
         }
      }
}