<?php
	session_start();

	if($_POST['login']){
		include("/data/config.php");
		$username = strip_tags($_POST['username']);
		$password = strip_tags($_POST['password']);

		$username = stripslashes($username);
		$password = stripslashes($password);

		$username = mysqli_real_escape_string($db, $username);
		$password = mysqli_real_escape_string($db, $password);

		$password = md5($password);

		$sql = "SELECT * FROM staff_users WHERE username ='$username' LIMIT 1";
		$query = mysqli_query($db, $sql);
		$row = mysqli_fetch_array($query);
		$id = $row['id'];
		$db_password = $row['password'];

		if($password = $db_password){
			$_SESSION['username'] = $username;
			$_SESSION['id'] = $id;
			header("Location: painel.php");
		}else{
			echo "Usuario ou senha incorretos";
		}
	}
?>