<?php
session_start();
date_default_timezone_set("Europe/Athens"); 
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>

<body>

<?php
if ($_SERVER['REQUEST_METHOD'] == 'POST') 
{
    require "dbconnect.php";

    $usr = $_POST['username']; 
    $pas = trim($_POST['password']);
    $usr = stripslashes($usr); 
    $pas = stripslashes($pas);
	$usr = mysqli_real_escape_string($con, $usr);
    $pas = mysqli_real_escape_string($con, $pas);
	$dt=date('Y-m-d');
    $_SESSION['islogin']='1';
	//check parameter table for parameters
	$sql1 = $dbcon->prepare("SELECT * FROM parameters " );
	$sql1->execute();
	$row1=$sql1->fetch(PDO::FETCH_ASSOC);
	$hpass=$row1['hpass'];
	
    $sql = $dbcon->prepare("SELECT * FROM teachers WHERE PMP=? and access > 2 " ); 
	$sql->execute([$usr]);
	$count=$sql->rowCount();
	if ($count > 0)
	{
		$row=$sql->fetch(PDO::FETCH_ASSOC);
		$hash=rtrim(ltrim($row['pass']));
	
		if ($hpass==1)
		{	
			$fl=password_verify($pas, $hash);
		}
		else
		{
			if ($pas==$hash) {$fl=true;} else {$fl=false;}
		}
	
		if ($fl) 
		{
			echo "**Επιτυχής επαλήθευση χρήστη";
			$name= $row['Name'];
			$ac=$row['access'];
			$year = date('Y', strtotime($dt));
			$day = date('d', strtotime($dt));
			$month = date('m', strtotime($dt));
			$_SESSION['tetramino']=$tetramino;
			$_SESSION['access']=$ac;
			$_SESSION['n']=$name;
			$_SESSION['usr']=$usr;
			$_SESSION['pmp']=$usr;
			$_SESSION['dt']=$dt;
			$_SESSION['islogin']='1';
			include "send.php";
		}
	}  
	else
	{
		echo " ΛΑΘΟΣ ΟΝΟΜΑ ΧΡΗΣΤΗ/ΚΩΔΙΚΟΣ - ΔΟΚΙΜΑΣΤΕ ΞΑΝΑ";
		$_SESSION['islogin']='';
		$dt2 = date('Y-m-d h:i:sa');
		$ip=$_SERVER['REMOTE_ADDR'];
		$sql2 = $dbcon->prepare("INSERT INTO reacons (ip,user,datelog,nots) VALUES (?,?,?,?)");
		$sql2->execute([$ip,$usr,$dt2,0]);
		$sql2 = $dbcon->prepare("INSERT INTO iplog (ip,user,datelog,nots) VALUES (?,?,?,?)");
		$sql2->execute([$ip,$usr,$dt2,0]);
		include "smslogin.php"; 
		mysqli_close($con);
		$dbcon=null;	
	}
}

?>
</body>
</html>