<?php

// Include config file
require_once 'config.php';
 
/* Attempt to connect to MySQL database */
$link = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
 
// Check connection
if($link === false){
    die('ERROR: Could not connect. ' . mysqli_connect_error());
}

    // Define variables and initialize with empty values
$username = $password = '';
$username_err = $password_err = '';
 
// Processing form data when form is submitted
if($_SERVER['REQUEST_METHOD'] == 'POST'){
 
    // Check if username is empty
    if(empty(trim($_POST['username']))){
        $username_err = 'Please enter username.';
    } else{
        $username = trim($_POST['username']);
    }
    
    // Check if password is empty
    if(empty(trim($_POST['password']))){
        $password_err = 'Please enter your password.';
    } else{
        $password = trim($_POST['password']);
    }
    
    // Validate credentials
    if(empty($username_err) && empty($password_err)){
        // Prepare a select statement
        $sql = 'SELECT id, username, password, upload_dir FROM users WHERE username = ?';
        
        if($stmt = mysqli_prepare($link, $sql)){

            // Bind variables to the prepared statement as parameters
            mysqli_stmt_bind_param($stmt, 's', $param_username);
            
            // Set parameters
            $param_username = $username;
            
            // Attempt to execute the prepared statement
            if(mysqli_stmt_execute($stmt)){
                
                // Store result
                mysqli_stmt_store_result($stmt);
                
                // Check if username exists, if yes then verify password
                if(mysqli_stmt_num_rows($stmt) == 1){                    
                    
                    // Bind result variables
                    mysqli_stmt_bind_result($stmt, $id, $username, $hashed_password, $upload_dir);
                    
                    if(mysqli_stmt_fetch($stmt)){
                        
                        if(password_verify($password, $hashed_password)){
                            
                            // Password is correct, so start a new session
                            session_start();
                            
                            // Store data in session variables
                            $_SESSION['loggedin'] = true;
                            $_SESSION['id'] = $id;
                            $_SESSION['username'] = $username;                            
                            $_SESSION['user_upload_dir'] = $upload_dir;

                            // Redirect user to welcome page
                            header('Location: index.php');
                        } else{
                            // Display an error message if password is not valid
                            $password_err = 'The password you entered was not valid.';
                        }
                    }
                } else{
                    // Display an error message if username doesn't exist
                    $username_err = 'No account found with that username.';
                }
            } else{
                echo 'Oops! Something went wrong. Please try again later.';
            }
        }
        
        // Close statement
        mysqli_stmt_close($stmt);
    }
    
    // Close connection
    mysqli_close($link);
}
?>
 
<!DOCTYPE html>
<html lang='en'>
<head>
    <meta charset='UTF-8'>
    <title>Login</title>
    <link rel='stylesheet' href='/static/css/bootstrap.min.css'>
    <style type='text/css'>
        .container {
            max-width: 350px;
        }
        textarea {
            resize: vertical;    /* allow only vertical stretch */
        }
        body {
            background-color: #f5f7fa;
        }
    </style>
</head>
<body>
    <div class='container'>
        <h2>Login</h2>
        <p>Please fill in your credentials to login.</p>
        <form action='<?php echo htmlspecialchars($_SERVER['PHP_SELF']); ?>' method='post'>
            <div class='form-group <?php echo (!empty($username_err)) ? 'has-error' : ''; ?>'>
                <label>Username</label>
                <input type='text' name='username' class='form-control' value='<?php echo $username; ?>'>
                <span class='help-block'><?php echo $username_err; ?></span>
            </div>    
            <div class='form-group <?php echo (!empty($password_err)) ? 'has-error' : ''; ?>'>
                <label>Password</label>
                <input type='password' name='password' class='form-control'>
                <span class='help-block'><?php echo $password_err; ?></span>
            </div>
            <div class='form-group'>
                <input type='submit' class='btn btn-primary' value='Login'>
            </div>
            <p>Don't have an account? <a href='register.php'>Sign up now</a>.</p>
        </form>
    </div>    
</body>
</html>