<?php
// 1. Session start must always be at the very top
session_start();

$servername = "localhost";
$username = "root";
$password = "";
$dbname = "my_db";

// Database connection (MySQLi)
$conn = new mysqli($servername, $username, $password, $dbname);

// If the form was submitted
if ($_SERVER["REQUEST_METHOD"] == "POST") {

    $user = $_POST['username'];
    $pass = $_POST['password'];

    // 2. Find the user in the database by username
    // (Prepared Statements should be used here for security, see Topic 24)
    $sql = "SELECT id, password_hash FROM users WHERE username = '$user'";
    $result = $conn->query($sql);

    if ($result->num_rows > 0) {
        $row = $result->fetch_assoc();

        // 3. Verify the password using password_verify
        if (password_verify($pass, $row['password_hash'])) {

            // Password is correct -> Save user data into Session
            $_SESSION["loggedin"] = true;
            $_SESSION["userid"] = $row["id"];
            $_SESSION["username"] = $user;

            echo "Welcome, you are logged in!";
        } else {
            echo "Incorrect password.";
        }
    } else {
        echo "User does not exist.";
    }
}
?>