<?php
session_start();
include('includes/db.php');

// Check if the form is submitted
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = isset($_POST["username"]) ? $_POST["username"] : "";
    $password = isset($_POST["password"]) ? $_POST["password"] : "";

    // Validate that both username and password are provided
    if (empty($username) || empty($password)) {
        $error_message = "Please enter both username and password";
    } else {
        // Use prepared statement to prevent SQL injection
        $query = "SELECT * FROM admin WHERE UserName = ?";
        $stmt = $conn->prepare($query);

        // Check if the prepare statement succeeded
        if ($stmt) {
            // Bind parameters
            $stmt->bind_param('s', $username);

            // Execute the query
            $stmt->execute();

            // Get result set
            $result = $stmt->get_result();

            // Fetch the user data
            $user = $result->fetch_assoc();

            // Close the statement
            $stmt->close();

            if ($user && password_verify($password, $user['Password'])) {
                // Authentication successful, set session
                $_SESSION["alogin"] = $username;

                // Add user stamp (you can customize the stamp as needed)
                $_SESSION['stamp'] = time(); // Stamp as timestamp

                // Include session validation
                include('session_validator.php');

                // Redirect to the dashboard
                header("Location: dashboard.php");
                exit();
            } else {
                // Invalid credentials, show an error message
                $error_message = "Invalid username or password";
            }
        } else {
            // Statement preparation failed, show an error message
            $error_message = "Error preparing SQL statement: " . $conn->error;
        }
    }
}
?>



<!DOCTYPE html>
<html>

<head>
    <link rel="stylesheet" href="css/loginstyle.css">
<style>
        .error-message {
            color: red;
           
        }
    </style>
    <title>User Login</title>
</head>

<body>
    <div class="login-page">
        <div class="form">
            <div class="login">
                <div class="login-header">
                    <h3>LOGIN</h3>
                    Welcome to Result Management System
                    <p>Please enter your credentials to login.</p>
                </div>
            </div>
            <form class="index.php" method="POST">
                <input type="text" id="username" name="username" placeholder="username" />
                <input type="password" id="password" name="password" placeholder="password" />
                <button type="submit" value="Login" name="login">Login</button>
                <?php
                // Display error message if set
                if (isset($error_message)) {
                    echo '<p class="error-message">' . $error_message . '</p>';
                }
                ?>
                <p class="message">Forget Password? <a href="updatepassword.php">Reset Password</a></p>
                <p class="message">Back Marks Entry? <a href="index.php">Marks Entry</a></p>
            </form>
        </div>
    </div>
</body>

</html>
