<?php
  session_start();
  $_SESSION['message'] = '';

  $msqli = new mysqli('localhost', 'root', '', 'accounts');

  if ($_SERVER['REQUEST_METHOD'] == 'POST'){
    // two passwords are equal to each other
    if ( $_POST['password'] == $_POST['confirmpassword'] ){
      $username = $mysqli->real_escape_string($_POST['username']);
      $email = $mysqli->real_escape_string($_POST['email']);
      $password = md5($_POST['password']); // md5 hash password security
      $avatar_path =  $mysqli -> real_escape_string('images/'.$_FILES['avatar']['name']);

      // make sure file type is an images
      if ( preg_match("!image!", $_FILES['avatar']['type']) ){
        // copy image to image folder
        if ( copy($_FILES['avatar']['tmp_name'], $avatar_path) ){
          $_SESSION['username'] = $username;
          $_SESSION['avatar'] = $avatar_path;

          $sql =
                 "INSERT INTO users (username, email, password, avatar) "
                 . "VALUES ('$username', '$email', '$password', '$avatar_path')";
          // if query successful - redirect to welcome page
          if ( $msqli -> query($sql) == true ){
            $_SESSION['message'] = "Registration successful! Added $username to the database!";
            header("location: welcome.php");
          }else{
            $_SESSION['message'] = "User could not be addedd to the database";
          }
        }else{
          $_SESSION['message'] = "File Upload Failed";
        }
      }else{
        $_SESSION['message'] = "File is not an image (PNG,GIF,JPG,SVG)";
      }
    }else{
      $_SESSION['message'] = "Passwords do not match";
    }
  }
?>