HEX

File: //opt/proundcontra.mosmuc.de/login.php
<?php
/***************************************************
 * login.php
 * 
 * Full-page example for user login using DB fields:
 *   users.userName
 *   users.password (hash)
 *   users.salt
 ***************************************************/

session_start();

// 1) SET YOUR DB CONNECTION HERE:
$dbHost     = 'localhost';
$dbUser     = 'mosmuc_pc';
$dbPassword = 'mmpc&44823';
$dbName     = 'mosmuc_pc';

try {
    $pdo = new PDO("mysql:host=$dbHost;dbname=$dbName;charset=utf8", $dbUser, $dbPassword, [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
    ]);
} catch (Exception $ex) {
    die("DB connection error: " . $ex->getMessage());
}

// If already logged in, maybe redirect or show message:
if (!empty($_SESSION['logged_in'])) {
    echo "LOGIN_ERROR_ALREADY_LOGGED_IN";
    exit;
}

$errorMsg = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    $password = trim($_POST['password'] ?? '');

    if ($username === '' || $password === '') {
        $errorMsg = "Please provide both username and password.";
    } else {
        // Look up user in DB:
        $stmt = $pdo->prepare("SELECT userId, userName, email, `group`, password, salt FROM users WHERE userName = :uname LIMIT 1");
        $stmt->execute([':uname' => $username]);
        $row = $stmt->fetch(PDO::FETCH_ASSOC);

        if (!$row) {
            // No such user
            $errorMsg = "LOGIN_ERROR_INVALID_USERNAME";
        } else {
            // Combine typed password with stored salt:
            $passwordWithSalt = $password . $row['salt'];
            // Check the hash:
            if (!password_verify($passwordWithSalt, $row['password'])) {
                $errorMsg = "LOGIN_ERROR_INVALID_PASSWORD";
            } else {
                // Success => set session
                $_SESSION['logged_in']   = true;
                $_SESSION['user_id']     = $row['userId'];
                $_SESSION['user_name']   = $row['userName'];
                $_SESSION['user_group']  = $row['group'];  // If =2 => admin ?

                // Optionally track last action:
                $update = $pdo->prepare("UPDATE users SET user_last_action = :ua WHERE userId = :uid");
                $update->execute([
                    ':ua'  => time(),
                    ':uid' => $row['userId']
                ]);

                // Redirect or just show a success
                header("Location: /?login=success");
                exit;
            }
        }
    }
}
?>
<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8"/>
    <title>Login - BPTArguments</title>
</head>
<body>
    <h1>Login</h1>

    <?php if ($errorMsg): ?>
        <div style="color:red;"><?php echo htmlspecialchars($errorMsg); ?></div>
    <?php endif; ?>

    <form action="/login" method="POST">
        <p>
            <label>Username:<br/>
                <input type="text" name="username" required>
            </label>
        </p>
        <p>
            <label>Password:<br/>
                <input type="password" name="password" required>
            </label>
        </p>
        <p>
            <button type="submit">LOGIN_SUBMIT</button>
        </p>
    </form>

    <p><a href="/signup">Need to create an account?</a></p>
</body>
</html>