original code:
if ($_POST['submitted'] == "1") {
	$username = addslashes(str_replace(' ','',$_POST['username']));
    $password = md5($_POST['password']);

    $allow = 0;
    $sql_result = pg_query("select * from user_login where login='".$username."' and is_blocked=false limit 1");
    $rows = pg_num_rows($sql_result);
    if ($rows) {
        $MyRS = pg_fetch_array($sql_result);
        if ($MyRS['password_hash']!='') {
            if (password_verify($_POST['password'], $MyRS['password_hash'])) $allow = 1;
        } else {
            if (md5($_POST['password'])==$MyRS['password']) $allow = 1;
        }
    }
    if ($allow) {
        // change password requrired
        if (intval($MyRS['change_password_required'])==1) {
            $resetcode = strtoupper(substr(md5(date('ymdHis')), 0,10));
            $_SESSION['user_email'] = $MyRS['email_address'];
            $_SESSION["user_login"] = $MyRS['login'];
            pg_query("update user_login set recovery_code='".$resetcode."' where email_address='".$_SESSION['user_email']."'");
            header("Location: /?resetcode=".$resetcode);
            die();
        }

        session_regenerate_id();
        $id_sesji = session_id();
        $smarty->assign('id_sesji', $id_sesji);

        $module = "";
        $_SESSION['login'] = 1;
        $page = "";
        $_SESSION['user_id'] = $MyRS['user_id'];
        $_SESSION["user_g"] = $MyRS['usergroup'];
        $_SESSION["user_login"] = $MyRS['login'];
        $_SESSION["user_station_list"] = $MyRS['station_list'];
        $_SESSION["time_start"] = time();
        $_SESSION['station_privileges'] = $MyRS['station_privileges'];

        $smarty->assign('user_login', $MyRS['login']);
        $sesja = session_id();

        if ($_SESSION['station_privileges'] == 10) $_SESSION['anonimizacja'] = 1;
        if ($_SESSION['station_privileges'] == 11) $_SESSION['anonimizacja'] = 2;
        if ($_SESSION['station_privileges'] == 12) $_SESSION['anonimizacja'] = 2;
        if ($_SESSION['station_privileges'] == 13) $_SESSION['anonimizacja'] = 0;

        if ($MyRS['notification_login']>0) {
			if (($MyRS["user_agent"]!=$_SERVER['HTTP_USER_AGENT']) | $MyRS['notification_login']==2) {
				$title = "Powiadomienie o logowaniu";
				$message = "Zarejestrowano logowonie na Twoje konto.<br><br>";
				$message .= "Data: <b>".date('Y-m-d H:i:s')."</b><br>";
				$message .= "USER_AGENT: <b>".$_SERVER['HTTP_USER_AGENT']."</b><br>";
				$message .= "REMOTE_ADDR: <b>".$_SERVER['REMOTE_ADDR']."</b><br><br>";
				$message .= "SERVER_NAME: <b>".$_SERVER['SERVER_NAME']."</b><br>";
				$message .= "HTTP_X_FORWARDED_HOST: <b>".$_SERVER['HTTP_X_FORWARDED_HOST']."</b><br><br>";
				$message .= "<font size='-1' color='gray'>Wiadomość wygenerowana automatycznie.</font>";
				SendEmail($MyRS['email_address'],$title,$message);
			}
        }

        $token = md5($_SESSION["user_login"] . strtotime(Date('YmdHis')));
		$password_hash = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);
        $sql = "update user_login set password_hash='".$password_hash."',token='".$token."',incorrect_login=0,last_login='".date("Y-m-d H:i:s")."',ip_address='".$_SERVER['REMOTE_ADDR']."',user_agent='".$_SERVER['HTTP_USER_AGENT']."' where user_id=".intval($_SESSION['user_id']);
        $_SESSION["user_token"] = $token;
        $smarty->assign('user_token', $token);
        pg_query($sql);

        //if ($_SESSION["user_g"]==1) $_SESSION['anonimizacja'] = 0;

        $apk = 'false';
        if (is_numeric(strpos($_SERVER['HTTP_USER_AGENT'],'RestSharp'))) $apk = 'true';

        $sql = "insert into work_time (user_id, start_time, stop_time, sesja, token, apk) values ('" . $MyRS['user_id'] . "','" . date("Y-m-d H:i:s") . "','" . date("Y-m-d H:i:s") . "','" . $sesja . "','" . $token . "','".$apk."')";
        pg_query($sql);

        //$sql = "update user_login set incorrect_login=0 where login='".$username."'";
        //pg_query($sql);


        WriteLog("zalogowanie", $_SESSION['user_id'], $sesja);


        header("Location: ");
    } else {

        $sql = "update user_login set incorrect_login=incorrect_login+1 where login='" . $username . "' and is_blocked=false";
        pg_query($sql);

        $sql = "select incorrect_login from user_login where login='" . $username . "'";
        $sql_result = pg_query($sql);
        $rows = pg_num_rows($sql_result);
        if ($rows) {
            $MyRS = pg_fetch_array($sql_result);
            if (intval($MyRS['incorrect_login']) > 4) {
                $sql = "update user_login set incorrect_login=0, is_blocked=true where login='" . $username . "'";
                pg_query($sql);
            }
        }

        $sql = "select * from user_login where login='" . $username . "' and is_blocked=true";
        $sql_result = pg_query($sql);
        $rows = pg_num_rows($sql_result);
        if ($rows) {
            $message = $lang['blocked_account'];
        } else {
            $message = $lang['wrong_authorization'];
        }

        $smarty->assign('message', $message);
    }
}