Goed gebruik

if(!isset($_POST['submit'])
{
    // hier het formulier
}
else
{
    $sql = mysql_query("SELECT nickname
                        FROM members
                        WHERE nickname = '" . mysql_real_escape_string($_POST['to']) . "'");
						
    if(empty($_POST['to'])
    {
        echo("Je bent vergeten in te vullen naar wie je het bericht wilt versturen.");
    }
    elseif(empty($_POST['msg'])
    {
        echo("Je moet wel een bericht versturen.");
    }
    elseif($_POST['to'] == $data['nickname'])
    {
        echo("Je kan geen bericht naar jezelf verzenden.");
    }
    else
    {
        if(mysql_num_rows($sql) == 0)
        {
            echo("Deze persoon bestaat niet.");
        }
        else
        {
            echo("Je bericht is verzonden.");


            mysql_query("INSERT INTO
                         message_logs
                         (date,
                         info)
                         VALUES
                         ('" . time() . "',
                         '" . strtolower($res['nickname']) . " send a message to " . strtolower($_POST['to']) . "'
                         )");


            mysql_query("INSERT INTO
                         message
                         (date,
                         from
                         to,
                         subject,
                         msg,
                         removed,
                         read)
                         VALUES
                         ('" . time() . "',
                         '" . strtolower($data['nickname']) . "',
                         '" . strtolower($_POST['to']) . "',
                         '" . addslashes($_POST['subject']) . "',
                         '" . addslashes($_POST['msg']) . "',
                         'no',
                         'no'
                         )");
        }
    }
}

// copyright: Youri van Mill
// date:      10-12-2010


if(!isset($_POST['submit'])) 
{
    echo("<form method=\"post\" action=\"\">
    <table>
    <tr>
        <td>Gebruikersnaam:</td>
        <td><input type=\"text\" name=\"nickname\" /></td>
    </tr>
    <tr>
        <td>Wachtwoord:</td>
        <td><input type=\"password\" name=\"password\" /></td>
    </tr>
    <tr>
        <td colspan=\"2\"><input type=\"submit\" name=\"submit\" value=\"Login\" /></td>
    </tr>
    </table>
</form>");
}
else
{
    $sql = mysql_query("SELECT *
                        FROM members 
                        WHERE nickname = '" . mysql_real_escape_string($_POST['nickname']) . "'");


    if(empty($_POST['nickname']))
    { 
        echo("Je bent vergeten een gebruikersnaam in te vullen."); 
    } 
    elseif(empty($_POST['password']))
    { 
        echo("Je hebt geen wachtwoord ingevult."); 
    }
    else
    {
        if(mysql_num_rows($sql) == 0)
        { 
            echo("Deze persoon bestaat niet."); 
        } 
        else
        {
            $res = mysql_fetch_assoc($sql);
                    
            if(md5($_POST['password']) != $res['password'])
            {
                echo("Je wachtwoord komt niet overeen met het wachtwoord die past bij de gebruikersnaam.");
            }
            else
            {
                $_SESSION['nickname'] = strtolower($_POST['nickname']);


                mysql_query("INSERT INTO 
                             member_logs 
                             (date, 
                             info) 
                             VALUES
                             ('" . time() . "',
                             '" . $_SESSION['nickname'] . " logged in.')"); 
                             
                mysql_query("UPDATE
                             members
                             SET onlinedate = '" . time() . "'
                             WHERE nickname = '" . $_SESSION['nickname'] . "'");


                header("location: /index.php");
            }
        }
    }
}