<?php
 include('dbconnect.php');
 
 //validate login
$page = 'ccb_login' ;
 
 	if(isset($_POST['AccLogin']))
{
	// Checking whether the Login form has been submitted

	$err = array();
	// Will hold our errors

	if(empty( $_POST['userid'])|| empty($_POST['current_password'])){
	$err = 'Invalid ID/pin try again!';
    header("location:".$page."?error=".$err."&id=0110");
	}

	if(!count($err)) {
	$pass= $_POST['current_password'];
    $user=$_POST['userid'];

		// Escaping all input data'".$user."'

		$query = mysql_query("SELECT Username,Pin,just_login,FullName,email,user_id FROM cleintuser WHERE Username='$user' AND Pin='$pass'")or die(myql_error());
		if(mysql_num_rows($query) > 0){
		$row=mysql_fetch_assoc($query);
			// If everything is OK login
		$FullName = $row['FullName'];
		$cemail = $row['email'];
		$user_id = $row['user_id'];
 	    $just_login = $row['just_login'];
 	    $last_login = $row['last_login'];
    	$ttime = time();

 			mysql_query("UPDATE cleintuser SET last_login = '$just_login' WHERE user_id = '$user_id'")or die(myql_error()); 
 			
 			mysql_query("UPDATE cleintuser SET just_login = '$ttime' WHERE user_id = '$user_id'")or die(myql_error()); 	
 			if ($last_login==''){
        	mysql_query("UPDATE cleintuser SET last_login = '$ttime' WHERE user_id = '$user_id'")or die(myql_error());  
            }
 		
	    	$_SESSION['Username'] =  $row['Username'];
			$_SESSION['userid'] = $row['user_id'];
			
	header("location:Secure.php?SSID=".md5($username.$row['Pin']));
    	}else{
    $err ='Invalid ID/pin try again!';
    header("location:".$page."?error=".$err."&id=0110");
 
    	}
 
	}
 
 
}
?>