trying to mod download.php

[voogru]

trying to mod this download.php to reject members who havent been authed by the email.

heres what i got:

PHP Code:

<?
############################################
# Hack by: GameZilla                       #
# E-mail: [email]gamezilla@socal.rr.com[/email]           #
# Forum: [url]http://www.otakuforums.com[/url]        #
############################################

$file_name = "".basename($file);
include("config.inc");
$mysql['user']   = "voogru";
$mysql['pass']   = "password";
$mysql['db']     = "voogru_website";
$mysql['table']  = "user";

$link = mysql_connect("localhost",$mysql['user'],$mysql['pass']);
mysql_select_db($mysql['db']);

$user = ($HTTP_COOKIE_VARS['user']) ? $HTTP_COOKIE_VARS['user'] : $HTTP_POST_VARS['user'];
$pass = ($HTTP_COOKIE_VARS['pass']) ? $HTTP_COOKIE_VARS['pass'] : $HTTP_POST_VARS['pass'];

$r  = mysql_query("SELECT userid,username,password,usergroupid FROM $mysql[table] WHERE username='$user'");
while ($row = mysql_fetch_array($r))
{
    if(strtolower($user) == strtolower($row['username']) && md5($pass) == $row['password'])
    {

    if ($usergroupid == '3') {
    exit;
 }

    else
        setcookie("user","$user",time() + (120 * 120));
        setcookie("pass","$pass",time() + (120 * 120));
        header("location: $file");
        exit();
    }

}
$data = addslashes(implode("",file("http://www.voogru.com/files/login.phtml")));
eval("echo stripslashes(\"$data\");");
exit();
?>

however when i do that i did a test user and i was still able to download the file.

any ideas?