<?php
session_start();
include("connect.php");

$username = trim($_POST['username']);
$password = trim($_POST['password']);

$stmt = mysqli_prepare($conn, "SELECT id, username, password FROM users WHERE username = ? AND status = 1");
mysqli_stmt_bind_param($stmt, "s", $username);
mysqli_stmt_execute($stmt);

$result = mysqli_stmt_get_result($stmt);

if ($row = mysqli_fetch_assoc($result)) {

    if (password_verify($password, $row['password'])) {
        $_SESSION['user_id'] = $row['id'];
        $_SESSION['username'] = $row['username'];
        header("Location: upload_statement.php");
        exit;
    }
}

header("Location: login.php?error=1");
exit;
?>
