<?php
include '../connect.php';
session_start();

function sanitizeString($var)
{
    $var = stripslashes($var);
    $var = htmlentities($var);
    $var = strip_tags($var);
    return $var;
}

if (isset($_POST['kadPengenalan']))
{
	$kadPengenalan = sanitizeString($_POST['kadPengenalan']);
	$password = sanitizeString($_POST['password']);

	
	if ($kadPengenalan == "" || $password == "")
	{
		echo "<script>alert('Sila masukkan ID Pengguna dan katalaluan anda! ');";
			echo "window.location.href = 'login.php';</script>";
	}
	else
	{

		//admin
		$query = "SELECT * FROM user WHERE katalaluan_user ='".$password."' AND kad_pengenalan ='".$kadPengenalan."' AND peranan_user='ADMIN' AND status='APPROVED' "; 
		$result = mysqli_query ($conn, $query) or exit("The query could not be performed");
		
		//user
		$query1 = "SELECT * FROM user WHERE katalaluan_user ='".$password."' AND kad_pengenalan ='".$kadPengenalan."' AND peranan_user='USER' AND status='APPROVED' "; 
		$result1 = mysqli_query ($conn, $query1) or exit("The query could not be performed");
		
		//superadmin
		$query2 = "SELECT * FROM user WHERE katalaluan_user ='".$password."' AND kad_pengenalan ='".$kadPengenalan."' AND peranan_user='SUPER ADMIN' AND status='APPROVED' "; 
		$result2 = mysqli_query ($conn, $query2) or exit("The query could not be performed");
		
		//KB/KU
		$query3 = "SELECT * FROM user WHERE katalaluan_user ='".$password."' AND kad_pengenalan ='".$kadPengenalan."' AND peranan_user='KB/KU' AND status='APPROVED' "; 
		$result3 = mysqli_query ($conn, $query3) or exit("The query could not be performed");
		
		
		if (mysqli_num_rows($result) == 1)
		{
		
			date_default_timezone_set("Asia/Kuala_Lumpur");			
			$date=date('Y-m-d');
			$time=date('H:i:sa');
			
			
			$query4="INSERT INTO audit_trail(kad_pengenalan,tarikh,masa,operasi,catatan)
					VALUES ('$kadPengenalan','$date','$time','login','Login sebagai Admin')";
			$strQuery = mysqli_query($conn,$query4);
			if($strQuery)
			{
				$_SESSION["kadPengenalan"] = $kadPengenalan;
				$_SESSION["password"] = $password;
				$_SESSION['last_activity'] = time(); 
				header ("location:../DashboardAdmin.php");
			}
			else
			{
				echo 'MySQL Error: ' . mysqli_error($conn);
			exit;
			}

		}
		else if(mysqli_num_rows($result1) == 1)
		{
			date_default_timezone_set("Asia/Kuala_Lumpur");			
			$date=date('Y-m-d');
			$time=date('H:i:sa');
			
			
			$query4="INSERT INTO audit_trail(kad_pengenalan,tarikh,masa,operasi,catatan)
					VALUES ('$kadPengenalan','$date','$time','login','Login sebagai User')";
			$strQuery = mysqli_query($conn,$query4);
			if($strQuery)
			{
				$_SESSION["kadPengenalan"] = $kadPengenalan;
				$_SESSION["password"] = $password;
				$_SESSION['last_activity'] = time(); 
				header ("location:../pageUser.php");
			}
			else
			{
				echo 'MySQL Error: ' . mysqli_error($conn);
			exit;
			}
			
		}
		else if(mysqli_num_rows($result2) == 1)
		{
			date_default_timezone_set("Asia/Kuala_Lumpur");			
			$date=date('Y-m-d');
			$time=date('H:i:sa');
			
			
			$query4="INSERT INTO audit_trail(kad_pengenalan,tarikh,masa,operasi,catatan)
					VALUES ('$kadPengenalan','$date','$time','login','Login sebagai Super Admin')";
			$strQuery = mysqli_query($conn,$query4);
			if($strQuery)
			{
				$_SESSION["kadPengenalan"] = $kadPengenalan;
				$_SESSION["password"] = $password;
				$_SESSION['last_activity'] = time(); 
				header ("location:../approvePage.php");
			}
			else
			{
				echo 'MySQL Error: ' . mysqli_error($conn);
			exit;
			}
			

		}
		else if(mysqli_num_rows($result3) == 1)
		{
			date_default_timezone_set("Asia/Kuala_Lumpur");			
			$date=date('Y-m-d');
			$time=date('H:i:sa');
			
			
			$query4="INSERT INTO audit_trail(kad_pengenalan,tarikh,masa,operasi,catatan)
					VALUES ('$kadPengenalan','$date','$time','login','Login sebagai KB/KU')";
			$strQuery = mysqli_query($conn,$query4);
			if($strQuery)
			{
				$_SESSION["kadPengenalan"] = $kadPengenalan;
				$_SESSION["password"] = $password;
				$_SESSION['last_activity'] = time(); 
				header ("location:../pageUser.php");
			}
			else
			{
				echo 'MySQL Error: ' . mysqli_error($conn);
			exit;
			}
			

		}

		else
		{
			echo "<script>alert('Log masuk gagal. Sila masukkan semula id pengguna dan katalaluan dengan  betul! ');";
			echo "window.location.href = '../index.html';</script>";
			exit;
		}
	}
}

?>