<?php
$sign_in_msg = "";
$sign_in_status = "";


if (isset($_POST['login'])) {
	$username = mysql_real_escape_string($_POST['username']);
	$password = mysql_real_escape_string(md5($_POST['password']));
		
	$query = "SELECT * FROM user WHERE Username = '$username' AND Password = '$password' AND Verified = 1 ";
	$result = mysql_query ($query);
	$nr = mysql_num_rows ($result);

	if ($nr != 1) {
		// ERROR - Multiple users or attack!!!
		/* ?>
        <script type="text/javascript">
		window.location = '?page=home';
		</script>
        <?php */
		$success = 0;
		$userId = 0;
		
		$sign_in_msg = "Usrname and Password don't match, or Your account is not verified.";
		$sign_in_status = 'error';
		
	} else {
		$success = 1;
		$row = mysql_fetch_array ($result);
		extract ($row);
		$_SESSION['id'] = $Id;
		$userId = $_SESSION['id'];
		$_SESSION['priv'] = $Privilegy;
		$_SESSION['user'] = $Username;
		$_SESSION['fullname'] = $FullName;
		
		//remember
		setcookie("cook_user", $_SESSION['user'], time()+60*60*24*10, "/");
      	setcookie("cook_id", $_SESSION['id'], time()+60*60*24*10, "/");
		setcookie("cook_priv", $_SESSION['priv'], time()+60*60*24*10, "/");
      	setcookie("cook_fullname", $_SESSION['fullname'], time()+60*60*24*10, "/");
		
		
	}
	
	// LOG UPDATE
	$res = mysql_query ("INSERT INTO log (Username, Date, UserId, Success) VALUES ('$username', NULL, '$userId', '$success')" );


} else if ($_GET['page'] == 'logout') {
	
	//remember
	setcookie("cook_user", $_SESSION['user'], time()-60*60*24*10, "/");
    setcookie("cook_id", $_SESSION['id'], time()+60-60*24*10, "/");
	setcookie("cook_priv", $_SESSION['priv'], time()-60*60*24*10, "/");
    setcookie("cook_fullname", $_SESSION['fullname'], time()-60*60*24*10, "/");
		
	session_unregister($_SESSION['user']);
	session_unregister($_SESSION['id']);
	session_unregister($_SESSION['priv']);
	session_unregister($_SESSION['fullname']);

	session_destroy ();
	?>
	<script type="text/javascript">
	window.location = '?page=home';
	</script>
<?php
	
} else if (!isset($_SESSION['visit'])) {
	//echo "first visit";
	$_SESSION['visit'] = 1;
	if (isset($_COOKIE['cook_user']) and 
		isset($_COOKIE['cook_id']) and 
		isset($_COOKIE['cook_priv']) and 
		isset($_COOKIE['cook_fullname'])) {	
	
		$_SESSION['user'] = $_COOKIE['cook_user'];
		$_SESSION['id'] = $_COOKIE['cook_id'];
		$_SESSION['priv'] = $_COOKIE['cook_priv'];
		$_SESSION['fullname'] = $_COOKIE['cook_fullname'];
	
		$username = $_SESSION['user'];
		$userId = $_SESSION['id'];
		$priv = $_SESSION['priv'];	
	
		$query = "SELECT * FROM user WHERE Username = '$username' AND Id = '$userId' AND Privilegy = '$priv' AND Verified = 1 ";
		$result = mysql_query ($query);
		$nr = mysql_num_rows ($result);

		if ($nr != 1) {
			// ERROR - Multiple users or attack!!!
			 ?>
	        <script type="text/javascript">
			window.location = '?page=logout';
			</script>
	        <?php 
		} else {
			$success = 1;
			$userId = $_SESSION['id'];
			
			// LOG UPDATE
			$datetime = getdate();
			$formated_date = $datetime['year'] . "-" . $datetime['mon'] . "-" . $datetime['mday']; 

			//echo $formated_date;

			$res = mysql_query ("SELECT Id, MAX(DATE(Date)) AS dd FROM log WHERE UserId = '$userId' ");
			$row = mysql_fetch_array ($res);
			extract ($row);
			$logId = $Id;
			//echo $dd;
			if ($dd == $formated_date) {
				$res = mysql_query ("UPDATE log SET Date = CURRENT_TIMESTAMP WHERE Id = $logId " );	
			} else {
				$res = mysql_query ("INSERT INTO log (Username, Date, UserId, Success) VALUES ('$username', NULL, '$userId', '$success')" );
			}
		} 
	}
} else {
	$username = 'Username';	
	$password = 'Password';
	$viewPrivatePages = " p.Public = 1 AND ";
}

?>