<?php session_start(); ?> <!-- session start -->
<?php include("include/config.php"); ?> <!-- database connection -->
<?php include("include/connect_url.php"); ?> <!-- connection url/link folder -->
<?php include("include/date_time.php"); ?> <!-- date & time format -->
<?php include("include/csrf.php"); ?> <!-- csrf -->
<?php include("database/account.php"); ?>  <!-- query database account -->
<?php include("include/lang.php"); ?> <!-- language -->

<?php
//post username
$username =mysql_real_escape_string($_POST['username']);

//post password
$password =mysql_real_escape_string($_POST['password']);

//get the POST csrf hash
$csrf_hash=$_POST['csrf_hash'];

//get the session csrf has
$session_csrf_hash=$_SESSION['csrf_hash'];

if($csrf_hash==$session_csrf_hash){

//user database
$query_user = mysql_query("SELECT * FROM tbl_user WHERE username = '$username' and a_status='1'"); 
$numrows_user = mysql_num_rows($query_user);
while($row= mysql_fetch_assoc($query_user))
  {
    $db_user_id= $row['id'];
    $db_user_username  = $row['username'];
    $db_user_password = $row['password'];
    $db_user_user_type_id = $row['user_type_id'];
  }

//check if exist username
if($numrows_user!=0)
{
 
if($username==$db_user_username&&md5($password)==$db_user_password)
{
$_SESSION['SessionUserLogUserID'] = $db_user_id;
$_SESSION['SessionUserLogUsername'] = $db_user_username;
$_SESSION['SessionUserLogPassword'] = $db_user_password;
$_SESSION['SessionUserUserTypeID'] = $db_user_user_type_id;


if($db_account_timezone_id==0||$db_account_country_id==0||$db_account_language_id==0||$db_account_currency_id==0||$db_account_number_format_id==0){
die ("<script>  alert('Please set timezone, country, language, currency and number format of your account.');
window.location.href='$connect_url_data/localisation';		
</script>");
}else
{
echo"<script>  
window.location.href='$connect_url_data/dashboard';		
</script> ";
}


}
else
$lang = $lang['Incorrect password.'];
die("<script> 
alert('$lang'); 
window.location.href='javascript:history.back();';
</script>");
}
else
$lang = $lang['This account does not exist.'];
die("<script> 
alert('$lang'); 
window.location.href='javascript:history.back();';
</script>");

}
else{
$lang = $lang['Invalid session request.'];
die("<script> 
alert('$lang'); 
window.location.href='javascript:history.back();';
</script>");
}
?>