<?php

$error_msg = '';

if(isset($_POST['login'])){

include('include/connection.inc.php');

    $username = mysqli_real_escape_string($conn, $_POST['username']);
    $password = mysqli_real_escape_string($conn, $_POST['password']);


if(empty($username) || empty($password))
    $error_msg = 'All fields must be filled';

else {

    $sql = "SELECT * FROM users WHERE username = '$username'";
    $result = mysqli_query($conn, $sql);
    $row = mysqli_fetch_assoc($result);
    $pwdCheck = password_verify($password, $row['password']);

    if($pwdCheck){

        session_start();
        $_SESSION['username'] = $row['username'];
        $_SESSION['firstname'] = $row['firstname'];
        $_SESSION['lastname'] = $row['lastname'];
        header('Location: index.php');

    } else $error_msg = 'Username or password incorrect';


}

}

?>