<?php
session_start();

$error = array();

include "config/koneksi.php";
include "config/konversi.php";
$tgl_user = date("Y-m-d H:i:s");

function anti_injection($data){
	$filter  = stripslashes(strip_tags(htmlspecialchars($data,ENT_QUOTES)));
	return $filter;
}

$user_id = anti_injection($_POST['user_id']);
$password = anti_injection(md5($_POST['password']));

// menghindari sql injection
$injeksi_user_id = mysqli_real_escape_string($konek, $user_id);
$injeksi_password = mysqli_real_escape_string($konek, $password);

// pastikan username dan password adalah berupa huruf atau angka.
if (!ctype_alnum($injeksi_user_id) OR !ctype_alnum($injeksi_password)) {
	$_SESSION['error'] = 'Gagal, pastikan username dan password berupa huruf atau angka!';
	header('Location: login_admin.php');
}


$query = "SELECT * FROM tbl_user WHERE user_id = '$user_id' AND password = '$password' AND aktif = 'Ya' ";
$login = mysqli_query($konek, $query);
$ketemu = mysqli_num_rows($login);
$data = mysqli_fetch_array($login);

// Apabila username dan password ditemukan
if ($ketemu > 0) {
	$_SESSION['user_id']		= $data['user_id'];
	$_SESSION['user_name']		= $data['user_name'];
	$_SESSION['level']			= $data['level'];

	$input = "UPDATE tbl_user SET login_time = '$tgl_user', status = 'ON' WHERE user_id ='$_SESSION[user_id]'";
	$hasil = mysqli_query($konek, $input);

	if ($data['level']=="Admin"){
		$_SESSION['Admin'] = $data['user_id'];
		header("Location: webadmin/media.php");
	}
	else if ($data['level']=="Siswa"){
		$_SESSION['Siswa'] = $data['user_id'];
		header("Location: index2.php");
	}

} else {
	$_SESSION['error'] = '<i class="fa fa-warning"></i>Gagal, Username atau Password Tidak Benar!';
	header('Location: login_admin.php');

}