setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch (PDOException $e) {
die("Database connection failed: " . $e->getMessage());
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
// Sanitize user inputs
$username = htmlspecialchars(trim($_POST['username']));
$password = htmlspecialchars(trim($_POST['password']));
// Fetch user from the database
$stmt = $db->prepare("SELECT * FROM users WHERE username = ?");
$stmt->execute([$username]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);
if ($user && password_verify($password, $user['password'])) {
// Regenerate session ID to prevent session fixation
session_regenerate_id(true);
// Set session variables
$_SESSION['loggedin'] = true;
$_SESSION['user'] = $user['username'];
// Redirect to the main page
header("Location: index.php");
exit;
} else {
$error = "Invalid username or password.";
}
}
?>
Login
Login
$error"; ?>