<?php
//session_start();
//require_once ('includes/config.inc.php'); 
$page_title = 'Login';
include ('includes/headr.php');

?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
 <head>
  <title> Login </title>
  <link href="includes/grid.css" rel="stylesheet" type="text/css">
  <link href="includes/panels.css" rel="stylesheet" type="text/css">
  <link href="includes/main.css" rel="stylesheet" type="text/css">
	<script type="text/javascript" src="js/jquery.js"></script>
	<script type="text/javascript" src="validation/jquery.validate.js"></script>
    <script type="text/javascript">
	$(document).ready(function(){
		$("#login").validate({
		rules: {
		 log1: "required",
		 pass: "required",
		},
		messages: {
			log1: "Please state your username or email.",
			pass: "Please enter a password",
			},		
	});
	}); 
  </script>
 </head>

 <?php

  //text search? redirect!
if (isset ($_GET['sitesearch'])){
	header('Location: home.php?sitesearch='.$_GET['sitesearch'].'');

}
	//after validating with jquery, escape the incoming data
	if (isset($_POST['submitted'])) {
	//require_once (MYSQL);	
	$log1 = mysqli_real_escape_string($dbc, $_POST['log1']); //you can log in either by username or email, checking below
    $password = mysqli_real_escape_string($dbc, $_POST['pass']);

	//checking in the query. we don't know if the user logged in with email or username
	$q = "SELECT * FROM user WHERE ((email='$log1' OR username='$log1') AND pass=SHA1('$password'))";
	$r = mysqli_query ($dbc, $q) or trigger_error("Query: $q\n<br />MySQL Error: " . mysqli_error($dbc));
	$error = "";
	$flag = @mysqli_num_rows($r);
	

	if (@mysqli_num_rows($r)==1) {// one row retrieved, a match was made


		// Register the values & redirect:
		$_SESSION = mysqli_fetch_array ($r, MYSQLI_ASSOC); 
		mysqli_free_result($r);
		$_SESSION['logged_in']=true;
		$_SESSION['same']='0';


		//Define if the person who logged in is a user or the administrator of the site
		$q1="SELECT * FROM admins WHERE user_id =".$_SESSION['user_id']."";
		$r1= mysqli_query($dbc, $q1) or trigger_error("Query: $q1\n<br />MySQL Error: " . mysqli_error($dbc));
		if (mysqli_num_rows($r1) == 1){
			//match found!
			$_SESSION['admin']=true;
		}
		else {
			$_SESSION['user']=true; //user is logged in. This session variable is a way to check which scripts will run and how.
		}

		//have we deactivated our profile?
		$q = "SELECT da_id FROM deactivated WHERE user_id ='".$_SESSION['user_id']."'";
		$r = mysqli_query ($dbc, $q) or trigger_error("Query: $q\n<br />MySQL Error: " . mysqli_error($dbc));
		if (mysqli_num_rows($r)==1) {//yes, we have!
			//profile is deactivated, unset session
			$_SESSION = array(); // Destroy the variables.
			session_destroy(); // Destroy the session itself.
			setcookie (session_name(), '', time()-300); // Destroy the cookie.
			$da=1;
				}
				else {
		
				mysqli_close($dbc);
				$url = "home.php"; // Define the URL:
				ob_end_clean(); // Delete the buffer.
				header("Location: $url");
				exit(); // Quit the script.
				}
			

	} //end if 
	else 
		$error = "<p style='color:purple;'>Incorrect or invalid email/username and password combination! Please try again!</p>";

	mysqli_close($dbc);

	}
?>

 <body>
 <div class="panel" id="log">
 <?php if (isset($da)) print'<p>We \'re pretty sure you have deactivated your account.</p>
			<p>Is that not the case?</p>
			<p>Contact our webmaster at webmaster@artroom.com with your registered email to solve this out!</p>';
			?>
 <form action="login.php" method="post" name="login" id="login">
 <table width=550 border="0" cellpadding="0" cellspacing="5">
 <tr> 
  <td height="22" align="right" valign="middle"><label for="log1" class="label">Username or Email </label></td>
  <td height="22" align="left" valign="middle"><input name="log1" type="text" id="name"></td>
  </tr> 
  <tr> 
  <td height="22" align="right" valign="middle"><label for="pass" class="label">Password </label></td> 
  <td height="22" align="left" valign="middle"><input name="pass" type="password" id="pass"></td><?php if (isset ($error))echo $error;?></span></br>
  </tr> 
  <tr>
  <td height="22" colspan="3" align="middle" valign="middle"><input type="submit" name="submit" id="submit" value="Log in"></td>
   </tr> 
  <tr>
  <td height="22" colspan="3" align="middle" valign="middle"><input type="hidden" name="submitted" value="TRUE" /></td>
  </tr> 
  <tr>
  <td height="22" colspan="3" align="middle" valign="middle"><p>You don\'t have an account? <a href="registration.php">Register.</a></p></td></tr>
  <tr>
  <td height="22" colspan="3" align="middle" valign="middle"><p>Forgot your password?</p><p>Contact our webmaster at webmaster@artroom.com with your registered email.</td>
  </tr>
  </table> 
 </form>
 </div>
  
 </body>
 <?php include ('includes/footer.php'); ?>
</html>
