if($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['login']) && isset($_POST['password']) && !isset($_SESSION['user']))
{
    $password = password_hash($_POST['password'], PASSWORD_DEFAULT);

    $user = $GLOBALS['database'] -> Select ('
        SELECT password, id, login, name, accesslevel
        FROM users
        WHERE (login = $1 OR email = $1)
        ', [$_POST['login']]
    );

    // no information or wrong password
    if (empty($user) || !password_verify($password, $user['password']))
        $bad_login = true;
    else
    {
        $user = $user[0];
        $_SESSION['user']['id']          = $user['id'];
        $_SESSION['user']['login']       = $user['login'];
        $_SESSION['user']['name']        = $user['name'];
        $_SESSION['user']['accesslevel'] = $user['accesslevel'];
    }
}