<?php # Script 16.8 - login.php
// This is the login page for the site.
ob_start();
session_start();
require_once ('includes/config.inc.php'); 
include('../includes/settings.php');
include('includes/mysql_connect.php'); 
include('includes/funcs.php');
if ($_SESSION['strFirstName'])
{
	header('Location:/member_home.php');
}
$page_title = 'Login';
include ('includes/header.html');

if (isset($_POST['submitted'])) 
{
	require_once (MYSQL);
	var_dump($_POST);
	// Validate the email address:
	if (!empty($_POST['username'])) 
	{
		$e = mysqli_real_escape_string ($dbc, $_POST['username']);
	}
	else 
	{
		$e = FALSE;
		$strValidation .= 'You forgot to enter your username!<br />';
	}
	
	// Validate the password:
	if (!empty($_POST['password'])) 
	{
		$pass = mysqli_real_escape_string ($dbc, $_POST['password']);
	}
	else 
	{
		$pass = FALSE;
		$strValidation .= 'You forgot to enter your password!<br />';
	}

	$strValidation .= 'Password is ' . $pass;
        $p = sha1($pass);
	$strValidation .= 'hashed is ' . $p;
	if ($e && $p) 
	{ // If everything's OK.

// $strValidation .= 'Email is '.$e .' and password is ' . $p;
		// Query the database:

		$q = "SELECT strEmail, strFirstName, activeYN FROM tblMembers WHERE (strEmail='$e' AND password='$p')";	
		$strValidation .= $q;
		// echo "$q";	
		$r = mysqli_query ($dbc, $q) or trigger_error("Query: $q\n<br />MySQL Error: " . mysqli_error($dbc));
		
		if (@mysqli_num_rows($r) == 1) 
		{ // A match was made.

			//update last login date
			// $w = "UPDATE tblUsers set dateLastLogin = NOW() WHERE (strUsername='$e' AND strPassword=SHA1('$p'))";		
			// $u = mysqli_query ($dbc, $w) or trigger_error("Query: $w\n<br />MySQL Error: " . mysqli_error($dbc));

			// Register the values & redirect:
			$_SESSION = mysqli_fetch_array ($r, MYSQLI_ASSOC); 
			mysqli_free_result($r);
			mysqli_close($dbc);

			ob_end_clean(); // Delete the buffer.
			header("Location: /member_home.php");
			exit(); // Quit the script.
				
		}
		else
		{ // No match was made.
			$strValidation .= 'Either the email address and password entered do not match those on file.<br />';
		}
		
	}
	else 
	{ // If everything wasn't OK.
		$strValidation .= 'Please try again.<br />';
	}
	
	mysqli_close($dbc);

} // End of SUBMIT conditional.
?>
<div id="listing">
	<h1>Login</h1>
	<p>Your browser must allow cookies in order to log in.</p>

	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post" id="postForm">
	<?php
		if ($strValidation != "")
		{
			echo '<div class="error">'.$strValidation.'</div>';			
		}
	?>
		<label for="username">Email Address:</label>
		<input type="text" name="username" title="Enter your username not your email address" />
		<label for="password">Password:</label>
		<input type="password" name="password" title="Enter your password." />

		<input type="submit" name="submit" value="Login" class="buttonsLINK" title="Click here to login." />
		 <a class="buttonsLINK" href="../" title="Click here to cancel logging in.">Cancel </a>
		<input type="hidden" name="submitted" value="TRUE" />
	
	</form>
</div>
<?php // Include the HTML footer.
include ('includes/footer.html');
?>
