<?php
session_start();
include '../db/db.php';

if (array_key_exists('login_admin', $_POST)) {
	$user = htmlspecialchars(trim($_POST['uname']), ENT_QUOTES, 'UTF-8');
	$pass = htmlspecialchars(trim($_POST['pwd']), ENT_QUOTES, 'UTF-8');
	$lang = htmlspecialchars(trim($_POST['lang']), ENT_QUOTES, 'UTF-8');
	
	$uname = strip_tags($user);
	$pwd = strip_tags($pass);

	$upass = hash('sha256', $pwd);

	$sql = mysqli_query($conn, "SELECT emp_id, user, pass FROM user_acc_tbl WHERE user='$uname' and access=1");	
	$row = mysqli_fetch_assoc($sql);
	
	if(mysqli_num_rows($sql) == 1) {		
		
		if($row['pass'] == $upass){
			$response['status'] = 'ok'; // log in
			$_SESSION['user'] = $row['user'];
			$_SESSION['emp_id'] = $row['emp_id'];
			$_SESSION['lang'] = $lang;
		
		} else{
			$response['status'] = 'error';
			// wrong details
			$response['message'] = '<span class="glyphicon glyphicon-info-sign"></span> &nbsp; Username or Password does not match.'; 
		}
	}
	
	else{
		$response['status'] = 'error';
		// wrong details
		$response['message'] = '<span class="glyphicon glyphicon-info-sign"></span> &nbsp; Username or Password does not match.'; 
	}
	echo json_encode($response);
}
?>