false, 'message' => 'Invalid CSRF token']); exit; } if (empty($email) || empty($password)) { echo json_encode(['success' => false, 'message' => 'Please fill in all fields.']); exit; } try { $stmt = $db->prepare("SELECT * FROM users WHERE email = ? AND user_type = 'user' AND status = 'approved'"); $stmt->execute([sanitizeInput($email)]); $user = $stmt->fetch(); if ($user && password_verify($password, $user['password'])) { $_SESSION['user_id'] = $user['id']; $_SESSION['user_name'] = $user['name']; $_SESSION['user_email'] = $user['email']; $_SESSION['user_type'] = $user['user_type']; $_SESSION['logged_in'] = true; $_SESSION['last_activity'] = time(); echo json_encode(['success' => true, 'message' => 'Login successful']); exit; } else { echo json_encode(['success' => false, 'message' => 'Invalid user credentials or account not approved.']); exit; } } catch (PDOException $e) { logError('User login error: ' . $e->getMessage()); echo json_encode(['success' => false, 'message' => 'Login failed. Please try again.']); exit; } } // Generate CSRF token for the form if (!isset($_SESSION['csrf_token'])) { $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); } include 'header.php'; include 'navbar.php'; ?>