<?php
session_start();
include "dbconfig.php";
$link =opencon();

if ( mysqli_connect_errno() ) {
	// If there is an error with the connection, stop the script and display the error.
	die ('Failed to connect to MySQL: ' . mysqli_connect_error());
}

$username=$_GET['user'];
$password1=$_GET['pass'];

if (isset($_POST['username'])) {
$username=$_POST['username'];
$password1=$_POST['password'];
}
	
if ( $username=='' ) {
	// Could not get the data that should have been sent.
	die ('Please fill both the username and password field!');
}
// Prepare our SQL, preparing the SQL statement will prevent SQL injection.
if ($stmt = $link->prepare('SELECT id,password,fullname,team_manager  FROM leads_accounts WHERE username = ?')) {
	// Bind parameters (s = string, i = int, b = blob, etc), in our case the username is a string so we use "s"
	$stmt->bind_param('s', $username);
	$stmt->execute();
	// Store the result so we can check if the account exists in the database.
	$stmt->store_result();
	
}
if ($stmt->num_rows > 0) {
	$stmt->bind_result($id,$password2,$fullname,$team_manager);
	$stmt->fetch();
	// Account exists, now we verify the password.
	// Note: remember to use password_hash in your registration file to store the hashed passwords.
        if ($password1 === $password2) {
		// Verification success! User has loggedin!
		// Create sessions so we know the user is logged in, they basically act like cookies but remember the data on the server.
	

		$_SESSION["loggedin"]=TRUE;
		$_SESSION["loggin"]=TRUE;
		$_SESSION["username"]=$username;
		$_SESSION["session_id"]=$id;
		$_SESSION["fullname"]=$fullname;
		$_SESSION['team_manager']=$team_manager;
	
		
echo "<script>window.location='lead_dashboard.php?login=success&user=$username';</script>";
     }
        else {
    

	echo "<script>window.location='index.php?login=error';</script>";

}
} else {
    

	echo "<script>window.location='index.php?login=error';</script>";

}
$stmt->close();
?>
