File manager

File manager - Edit - /home/webapp69.cm.in.th/u69319090036/Shop/login.php

Back
<?php // login.php - Login and Logout Page require_once 'db_connect.php'; // Handle Logout action if (isset($_GET['action']) && $_GET['action'] === 'logout') { $uid = $_SESSION['user_id'] ?? null; clearRememberMeCookie($pdo, $uid); session_unset(); session_destroy(); header("Location: index.php?success=" . urlencode("Logged out successfully.")); exit(); } // Redirect if already logged in if (isLoggedIn()) { header("Location: index.php"); exit(); } $errorMsg = ""; $successMsg = ""; $tab = $_GET['tab'] ?? 'password'; // 'password' or 'otp' // ─── Handle Password Login ──────────────────────────────────────────────────── if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['form'] ?? '') === 'password') { $loginInput = trim($_POST['login_input'] ?? ''); $password = $_POST['password'] ?? ''; $rememberMe = isset($_POST['remember_me']); if (empty($loginInput) \|\| empty($password)) { $errorMsg = "Please enter both username/email and password."; $tab = 'password'; } else { $stmt = $pdo->prepare("SELECT * FROM users WHERE (username = ? OR email = ?) AND password IS NOT NULL"); $stmt->execute([$loginInput, $loginInput]); $user = $stmt->fetch(); if ($user && password_verify($password, $user['password'])) { if ($user['is_banned']) { $errorMsg = "Your account has been banned by the administrator."; $tab = 'password'; } else { $_SESSION['user_id'] = $user['id']; $_SESSION['username'] = $user['username']; $_SESSION['role'] = $user['role']; if ($rememberMe) { setRememberMeCookie($pdo, $user['id']); } $redirect = $_GET['redirect'] ?? 'index.php'; header("Location: " . $redirect); exit(); } } else { $errorMsg = "Invalid username/email or password."; $tab = 'password'; } } } // ─── Handle Email OTP Request ───────────────────────────────────────────────── if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['form'] ?? '') === 'send_otp') { $email = trim($_POST['email'] ?? ''); $tab = 'otp'; if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { $errorMsg = "Please enter a valid email address."; } else { $token = generateAndSendOtp($pdo, $email); if ($token) { header("Location: verify_otp.php?token=" . urlencode($token) . "&success=" . urlencode("OTP sent! Check your email inbox.")); exit(); } else { $errorMsg = "Email not found or could not be sent. Make sure this email is registered."; } } } renderHeader(__('login_page_title')); ?> <div class="max-w-md mx-auto my-10 bg-white p-8 sm:p-10 rounded-2xl shadow-xl border border-gray-100/80"> <div class="text-center mb-8"> <div class="w-14 h-14 bg-orange-50 border border-orange-100 text-orange-600 rounded-2xl flex items-center justify-center mx-auto mb-3"> <svg class="w-7 h-7" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"/></svg> </div> <h1 class="text-2xl font-extrabold text-gray-900 tracking-tight"><?php echo __('login_heading'); ?></h1> <p class="mt-1.5 text-xs text-gray-500"><?php echo __('login_subheading'); ?></p> </div> <?php if (!empty($errorMsg)): ?> <div class="bg-red-50 border border-red-200 text-red-800 px-4 py-3 rounded-xl mb-5 text-sm font-semibold flex items-center gap-2.5"> <svg class="w-4 h-4 text-red-600 flex-shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/></svg> <span><?php echo sanitize($errorMsg); ?></span> </div> <?php endif; ?> <?php if (!empty($successMsg)): ?> <div class="bg-emerald-50 border border-emerald-200 text-emerald-800 px-4 py-3 rounded-xl mb-5 text-sm font-semibold flex items-center gap-2.5"> <svg class="w-4 h-4 text-emerald-600 flex-shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"/></svg> <span><?php echo sanitize($successMsg); ?></span> </div> <?php endif; ?> <!-- Tab Switcher --> <div class="flex bg-gray-100 p-1 rounded-xl mb-6 gap-1"> <button onclick="switchTab('password')" id="tab-btn-password" class="flex-1 py-2 text-xs font-bold rounded-lg transition-all <?php echo $tab === 'password' ? 'bg-white shadow-sm text-gray-900' : 'text-gray-500 hover:text-gray-700'; ?>"> <?php echo __('login_tab_password'); ?> </button> <button onclick="switchTab('otp')" id="tab-btn-otp" class="flex-1 py-2 text-xs font-bold rounded-lg transition-all <?php echo $tab === 'otp' ? 'bg-white shadow-sm text-gray-900' : 'text-gray-500 hover:text-gray-700'; ?>"> <?php echo __('login_tab_otp'); ?> </button> </div> <!-- Tab: Password Login --> <div id="tab-password" class="<?php echo $tab !== 'password' ? 'hidden' : ''; ?>"> <form action="login.php<?php echo isset($_GET['redirect']) ? '?redirect=' . urlencode($_GET['redirect']) : ''; ?>" method="POST" class="space-y-4"> <input type="hidden" name="form" value="password"> <div> <label for="login_input" class="block text-xs font-bold uppercase tracking-wider text-gray-500 mb-2"><?php echo __('login_label_login_input'); ?></label> <input type="text" name="login_input" id="login_input" required autocomplete="username" placeholder="<?php echo __('login_placeholder_login'); ?>" value="<?php echo isset($_POST['login_input']) ? sanitize($_POST['login_input']) : ''; ?>" class="w-full px-4 py-3 bg-gray-50 border border-gray-200 rounded-xl text-sm focus:outline-none focus:ring-2 focus:ring-orange-500/20 focus:border-orange-500 focus:bg-white transition-all"> </div> <div> <label for="password" class="block text-xs font-bold uppercase tracking-wider text-gray-500 mb-2"><?php echo __('login_label_password'); ?></label> <div class="relative"> <input type="password" name="password" id="password" required autocomplete="current-password" placeholder="••••••••" class="w-full px-4 py-3 bg-gray-50 border border-gray-200 rounded-xl text-sm focus:outline-none focus:ring-2 focus:ring-orange-500/20 focus:border-orange-500 focus:bg-white transition-all pr-16"> <button type="button" onclick="togglePw('password','pw-btn')" id="pw-btn" class="absolute right-3.5 top-1/2 -translate-y-1/2 text-gray-400 hover:text-gray-600 text-xs font-bold select-none"><?php echo __('login_show'); ?></button> </div> </div> <!-- Remember Me --> <label class="flex items-center gap-3 cursor-pointer select-none group"> <div class="relative"> <input type="checkbox" name="remember_me" id="remember_me" class="sr-only peer"> <div class="w-9 h-5 bg-gray-200 rounded-full peer peer-checked:bg-orange-500 transition-colors"></div> <div class="absolute top-0.5 left-0.5 w-4 h-4 bg-white rounded-full shadow transition-transform peer-checked:translate-x-4"></div> </div> <span class="text-xs text-gray-600 group-hover:text-gray-900 transition-colors"><?php echo __('login_remember_me'); ?></span> </label> <button type="submit" class="w-full py-3 px-4 bg-gradient-to-r from-orange-500 to-rose-500 text-white font-bold rounded-xl shadow hover:shadow-lg transition-all duration-200 hover:-translate-y-0.5 focus:outline-none text-sm"> <?php echo __('login_btn_signin'); ?> </button> </form> </div> <!-- Tab: Email OTP Login --> <div id="tab-otp" class="<?php echo $tab !== 'otp' ? 'hidden' : ''; ?>"> <div class="bg-blue-50/70 border border-blue-100 rounded-xl p-3.5 mb-5 flex gap-3 items-start"> <svg class="w-5 h-5 text-blue-600 flex-shrink-0 mt-0.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z"/></svg> <p class="text-xs text-blue-700 leading-relaxed"> <?php echo __('login_otp_info', ['min' => OTP_EXPIRE_MIN]); ?> </p> </div> <form action="login.php<?php echo isset($_GET['redirect']) ? '?redirect=' . urlencode($_GET['redirect']) : ''; ?>" method="POST" class="space-y-4"> <input type="hidden" name="form" value="send_otp"> <div> <label for="otp_email" class="block text-xs font-bold uppercase tracking-wider text-gray-500 mb-2"><?php echo __('login_label_email'); ?></label> <input type="email" name="email" id="otp_email" required autocomplete="email" placeholder="<?php echo __('login_placeholder_email'); ?>" value="<?php echo isset($_POST['email']) ? sanitize($_POST['email']) : ''; ?>" class="w-full px-4 py-3 bg-gray-50 border border-gray-200 rounded-xl text-sm focus:outline-none focus:ring-2 focus:ring-orange-500/20 focus:border-orange-500 focus:bg-white transition-all"> </div> <button type="submit" class="w-full py-3 px-4 bg-gradient-to-r from-blue-500 to-indigo-500 text-white font-bold rounded-xl shadow hover:shadow-lg transition-all duration-200 hover:-translate-y-0.5 focus:outline-none text-sm"> <?php echo __('login_btn_send_code'); ?> </button> </form> </div> <div class="mt-6 text-center text-xs text-gray-500"> <?php echo __('login_no_account'); ?> <a href="register.php" class="font-bold text-orange-500 hover:text-orange-600 ml-1"><?php echo __('login_register_link'); ?></a> </div> </div> <script> function switchTab(tab) { document.getElementById('tab-password').classList.toggle('hidden', tab !== 'password'); document.getElementById('tab-otp').classList.toggle('hidden', tab !== 'otp'); document.getElementById('tab-btn-password').className = 'flex-1 py-2 text-xs font-bold rounded-lg transition-all ' + (tab === 'password' ? 'bg-white shadow-sm text-gray-900' : 'text-gray-500 hover:text-gray-700'); document.getElementById('tab-btn-otp').className = 'flex-1 py-2 text-xs font-bold rounded-lg transition-all ' + (tab === 'otp' ? 'bg-white shadow-sm text-gray-900' : 'text-gray-500 hover:text-gray-700'); } function togglePw(inputId, btnId) { const input = document.getElementById(inputId); const btn = document.getElementById(btnId); input.type = input.type === 'password' ? 'text' : 'password'; btn.textContent = input.type === 'password' ? '<?php echo __('login_show'); ?>' : '<?php echo __('login_hide'); ?>'; } </script> <?php renderFooter(); ?>

| ver. 1.4 | Github | . | PHP 7.4.33 | Generation time: 0.27 | proxy | phpinfo | Settings