<!-- conteudo -->
<div class="conteudo">
  <p><h1> Login/Registar </h1></p>

    <!-- formulario login -->
    <?php

    if(!isset($_SESSION['username']) ){
      if(!isset($_SESSION['']) and !isset($_SESSION['tentativas'])){
        $_SESSION['codigo']=md5(rand());
        $_SESSION['tentativas']=0;
        $_SESSION['tempo_espera']=0;
      }
      if($_POST){
        $_SESSION['tentativas']++;
        if($_SESSION['tentativas']>10 and $_SESSION['tempo_espera']==0){
          $_SESSION['tempo_espera']=time()+120;
        } else {
          if($_SESSION['codigo']==$_POST['codigo']){
            $conexao = mysqli_connect("localhost", "root", "", "loja_online_lnarciso");
            $hash = md5($_POST['password']);
            $query = "SELECT * FROM utilizadores WHERE username = '{$_POST['username']}' and password = '{$hash}'";
            $resultado = mysqli_query($conexao,$query);
            $_SESSION['username']=$_POST['username'];
            header("Location: {$_SERVER['PHP_SELF']}");
          } else {
            echo "formulário inválido!</br>";
          }
      }

      } else if($_SESSION['tentativas']<10) {
      ?>

    <form method="POST" action="">
      <table align="center" width="300" border="0">

        <tr>
          <td><label>ENTRAR</label></td>
        </tr>
        <tr>
          <td><label>Username</label></td>
          <td><input type="text" name="username"><br></td>
        </tr>
        <tr>
          <td><label>Password</label></td>
          <td><input type="password" name="password"><br></td>
        </tr>
        <tr>
          <td>&nbsp;</td>
          <input type="hidden" name="codigo" value="<?php echo $_SESSION['codigo']; ?>" />
          <td><input type="submit" value="login"></td>
        </tr>
        <tr>
          <td><?php echo "<a href='utilizadores.php'><font color='black'> Registar </a></font>";?></td>
        </tr>

      </table>
    </form>

    <?php }
    if($_SESSION['tempo_espera'] < time() and $_SESSION['tentativas']>10){
      $_SESSION['tempo_espera']=0;
      $_SESSION['tentativas']=0;
    }
  } else {
      echo "<center>Login efetuado com sucesso!</center>";
  }
    ?>

</div>