prepare("SELECT * FROM account WHERE username = ?"); $stmt->execute([$username]); $user = $stmt->fetch(PDO::FETCH_ASSOC); // Check password hash or plain fallback if ($user && (password_verify($password, $user['password']) || $password === $user['password_enc'])) { $_SESSION['login_attempts_' . $user['id_account']] = 0; // reset $_SESSION['user_id'] = $user['id_account']; $_SESSION['name'] = $user['name']; $_SESSION['username'] = $user['username']; $_SESSION['password'] = $user['password_enc']; // store original password or enc version $_SESSION['role'] = 'account'; try { $pdo->exec("CREATE TABLE IF NOT EXISTS login_history ( id_log INT AUTO_INCREMENT PRIMARY KEY, id_account INT NOT NULL, device_info VARCHAR(255), ip_address VARCHAR(50), login_time DATETIME DEFAULT CURRENT_TIMESTAMP )"); $device = $_SERVER['HTTP_USER_AGENT'] ?? 'Unknown Device'; $ip = $_SERVER['REMOTE_ADDR'] ?? 'Unknown IP'; $stmtLog = $pdo->prepare("INSERT INTO login_history (id_account, device_info, ip_address) VALUES (?, ?, ?)"); $stmtLog->execute([$user['id_account'], $device, $ip]); } catch (PDOException $e) { } if (!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') { header('Content-Type: application/json'); echo json_encode(['success' => true, 'redirect' => 'dashboard.php']); exit; } header("Location: dashboard.php"); exit; } else { $error = "Invalid Username or Password."; if (!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') { header('Content-Type: application/json'); echo json_encode(['success' => false, 'error' => $error]); exit; } } } catch (PDOException $e) { $error = "A system error occurred."; if (!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') { header('Content-Type: application/json'); echo json_encode(['success' => false, 'error' => $error]); exit; } } } else { $error = "All fields are required."; if (!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') { header('Content-Type: application/json'); echo json_encode(['success' => false, 'error' => $error]); exit; } } } ?>