<?php
session_start();
require 'config.php';

if ( isset($_POST['username']) && isset($_POST['password']) ) {
    
    $sql_check = "SELECT fullname, 
                         level_user, 
                         id_user 
                  FROM users 
                  WHERE 
                       username=? 
                       AND 
                       password=? 
                  LIMIT 1";

    $sql = $mysqli->prepare($sql_check);
    $sql->bind_param('ss', $username, $password);

    $username = $_POST['username'];
    $password = md5( $_POST['password'] );

    $sql->execute();
    $sql->store_result();

    if ( $sql->num_rows == 1 ) {
        $sql->bind_result($fullname, $level_user, $id_user);

        while ( $sql->fetch() ) {
            $_SESSION['user_login'] = $level_user;
			$_SESSION['time'] = time();			
            $_SESSION['sess_id']  = $id_user;
            $_SESSION['fullname']  = $fullname;

            
        }

     $sql->close();
        header('location:'.$level_user);
     exit();

    } else {
        header('location: login.php?error='.base64_encode('ไม่สามารถเข้าระบบได้'));
        exit();
    }

   
} else {
    header('location:login.html');
    exit();
}