<?php
session_start();

// Database connection
$conn = new mysqli("localhost", "nodor", "D@n33Nao40", "wcfs");

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Check if form is submitted
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'];
    $password = $_POST['password'];

    // Query the database for the user
    $sql = "SELECT password_hash FROM users WHERE username = ?";
    $stmt = $conn->prepare($sql);
    $stmt->bind_param("s", $username);
    $stmt->execute();
    $stmt->store_result();

    if ($stmt->num_rows > 0) {
        // User exists, verify the password
        $stmt->bind_result($hashedPassword);
        $stmt->fetch();

        if (password_verify($password, $hashedPassword)) {
            // Password is correct, set session and redirect
            $_SESSION['authenticated'] = true;
            header("Location: admin_dashboard.php");
            exit();
        } else {
            // Incorrect password
            header("Location: admin_login.php?error=invalid_credentials");
            exit();
        }
    } else {
        // Username not found
        header("Location: admin_login.php?error=invalid_credentials");
        exit();
    }

    $stmt->close();
}

$conn->close();
?>