false, 'message' => 'Invalid CSRF token']); exit; } if (empty($login_input) || empty($password)) { echo json_encode(['success' => false, 'message' => 'Please fill in all fields.']); exit; } try { // Check if input is email or phone $field = filter_var($login_input, FILTER_VALIDATE_EMAIL) ? 'email' : 'mobile'; $stmt = $db->prepare("SELECT * FROM users WHERE $field = ? AND user_type = 'member' AND status = 'approved'"); $stmt->execute([$login_input]); $user = $stmt->fetch(); if ($user && password_verify($password, $user['password'])) { $_SESSION['user_id'] = $user['id']; $_SESSION['user_name'] = $user['name']; $_SESSION['user_email'] = $user['email']; $_SESSION['user_type'] = $user['user_type']; $_SESSION['status'] = $user['status']; $_SESSION['logged_in'] = true; $_SESSION['last_activity'] = time(); // Handle redirect after login $redirect_url = $_SESSION['redirect_after_login'] ?? (SITE_URL . '/admin/index.php'); unset($_SESSION['redirect_after_login']); echo json_encode(['success' => true, 'message' => 'Login successful', 'redirect' => $redirect_url]); exit; } else { echo json_encode(['success' => false, 'message' => 'Invalid credentials or account not approved.']); exit; } } catch (PDOException $e) { logError('Member login error: ' . $e->getMessage()); echo json_encode(['success' => false, 'message' => 'Login failed. Please try again later.']); exit; } } // Generate CSRF token for the form $csrf_token = generateCSRF(); include 'header.php'; include 'navbar.php'; ?>