<?php
    //Start session
    session_start();

    //Array voor validatie-errors
    $errmsg_arr = array();

    //Validatie error flag
    $errflag    = false;

    include_once('dblogin.inc.php');


    function clean($str) {
        $str = trim($str);          //whitespaces e.d. aan het eind van de string weghalen
        if(get_magic_quotes_gpc()) {    //
            $str = stripslashes($str);
        }
        //encodeer vreemde tekens voor gebruik in SQL-queries
        return mysql_real_escape_string($str);
    }

    //Sanitize the POST values
    $login      = clean($_POST['login']);
    $password   = clean($_POST['password']);

    //Input valideren
    if($username == '') {
        $errmsg_arr[] = 'Gebruikersnaam ontbreekt';
        $errflag = true;
    }
    if($password == '') {
        $errmsg_arr[] = 'Wachtwoord ontbreekt';
        $errflag = true;
    }

    //Als er input validation errors zijn, redirect de gebruiker terug naar het login-scherm
    if($errflag) {
        $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
        session_write_close();
        header("location: login-form.php");
        exit();
    }

    //Maak queries voor tabellen 'student' en 'werknemer'
    //query 'student'
    $result_student = mysql_query("SELECT * FROM student WHERE username='$login' AND password='".md5($_POST['password'])."'",$db);
    //query 'werkgever'
    $result_werkgever = mysql_query("SELECT * FROM werkgever WHERE username='$login' AND password='".md5($_POST['password'])."'",$db);
    //Check of student query succesvol verlopen is
    if($result_student) {
        if(mysql_num_rows($result_student) == 1) {
            //Login succesvol
            $member = mysql_fetch_assoc($result_student);
            $_SESSION['SESS_STUDENTNUMMER'] =   $member['studentnummer'];
            $_SESSION['SESS_USERNAME'] =        $member['username'];
            $_SESSION['SESS_NAME'] =            $member['naam'];
            $_SESSION['SESS_ACCOUNT_TYPE'] =    "student";
            session_write_close();
            header("location: member-index.php");
            exit();
        }else if (!isset($_SESSION['SESS_USERNAME'])){
            //Login mislukt
            header("location: login-failed.php");
            exit();
        }
    }else if($result_werkgever){
        if(mysql_num_rows($result_student) == 1) {
            //Login succesvol
            $member = mysql_fetch_assoc($result_werkgever);
            $_SESSION['SESS_USERNAME'] =        $member['username'];
            $_SESSION['SESS_NAME'] =            $member['naam'];
            $_SESSION['SESS_ACCOUNT_TYPE'] =    "werkgever";
            session_write_close();
            header("location: member-index.php");
            exit();
        }else if (!isset($_SESSION['SESS_USERNAME'])){
                //Login mislukt
                header("location: login-failed.php");
                exit();
        }
    }else{
        die("Query mislukt");
    }

?>