prepare("SELECT UId, UName, UEmail, UPassword, URole FROM users WHERE UName = ?"); $stmt->bind_param("s", $username); $stmt->execute(); $result = $stmt->get_result(); if ($result->num_rows == 0) { $login_err = "Invalid username or password."; } elseif ($result->num_rows > 1) { $login_err = "Overlapping username found. Contact Admin!"; } else { $row = $result->fetch_assoc(); $stmt->close(); // Accounts awaiting email confirmation must not be able to log in. if($row['URole'] === 'pending'){ $login_err = "Your account is not yet activated. Please check your email for the confirmation link."; } elseif(password_verify($password, $row['UPassword'])){ // Prevent session fixation: issue a fresh session id on login. session_regenerate_id(true); // Store data in session variables $_SESSION["loggedin"] = true; $_SESSION["UId"] = $row["UId"]; $_SESSION["UName"] = $row["UName"]; $_SESSION["URole"] = $row["URole"]; $DEmail = getDriverEmail($conn, $_SESSION["UId"]); if(!empty($DEmail)){ $_SESSION["UEmail"] = $DEmail; }else{ $_SESSION["UEmail"] = $row["UEmail"]; } // Find Driver Name $dstmt = $conn->prepare("SELECT DPic, DName, DContact, DClass, DLicense, DLCheck, DFuelCard FROM drivers WHERE DUserID = ?"); $dstmt->bind_param("i", $_SESSION["UId"]); $dstmt->execute(); $result = $dstmt->get_result(); if ($result->num_rows == 1) { $row = $result->fetch_assoc(); if(!empty($row["DName"]) && ($row["DName"] !== $_SESSION["UName"])){ $_SESSION["DName"] = $row["DName"]; }else{ $_SESSION["DName"] = $_SESSION["UName"]; } } else { $_SESSION["DName"] = $_SESSION["UName"]; } // Redirect user to welcome page $dstmt->close(); $conn->close(); header("Location: index.php"); exit; } else { $login_err = "Username / Password mismatched."; } } $conn->close(); } } // Header output must come AFTER the POST block: it emits HTML, and once any // output is sent, session_regenerate_id() and the header("Location: ...") // redirect above both fail silently, leaving a correct login stranded on // this page with no error shown. load("loginheader"); ?>