<?php
 session_start();
 $host = "localhost";
 $username = "toxic";
 $password = "sysop2018";
 $database = "oversurgery";
 $message = "";
 try
 {
      $connect = new PDO("mysql:host=$host; dbname=$database", $username, $password);
      $connect->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
      if(isset($_POST["loginbtn"]))
      {
           if(empty($_POST["username"]) || empty($_POST["password"]))
           {
                $message = '<label>All fields are required</label>';
           }
           else
           {
                $query = 'SELECT * FROM register WHERE username = :username AND password = :password';
                $statement = $connect->prepare($query);
                $statement->execute(
                     array(
                          ':username' => $_POST["username"],
                          ':password' => $_POST["password"]
                     ));
                $count = $statement->rowCount();
                if($count > 0)
                {
                  //fetch row
                  $row = $statement->fetch(PDO::FETCH_OBJ);
                  $_SESSION["username"] = $_POST["username"];
                  $_SESSION["userid"] = $row->userid;
                  header("location:dashboard.php");
                }
                else
                {
                     $message = '<div id="alert1" class="alert alert-danger alert-dismissible" role="alert">
                     <button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>Invalid Username or Password.<div>';
                }
           }
      }
 }
 catch(PDOException $error)
 {
      $message = $error->getMessage();
 }
 ?>