<?php
/**
 * update_last.php - BUG FIXED VERSION
 * Fixes:
 * 1. Duplicate check: was $username != "" && $username != "" (same variable twice)
 *    Now correctly checks both username and password
 * 2. Added real_escape_string for SQL safety
 */
include 'anti.php';
include 'konak.php';
date_default_timezone_set("Asia/Jakarta");

if (isset($_POST['username'])) {
    $username = anti_injection($_POST['username']);
    $password = anti_injection($_POST['password']);
    $date     = date('Y/m/d H:i:s');

    // FIX: was checking $username twice - now checks both username and password
    if ($username != "" && $password != "") {
        $esUser = mysqli_real_escape_string($koneksi, $username);
        $esDate = mysqli_real_escape_string($koneksi, $date);
        $sql    = "UPDATE user_id SET last='$esDate' WHERE username='$esUser'";
        if (mysqli_query($koneksi, $sql)) {
            echo "sucsess";
        } else {
            echo "filed";
        }
    } else {
        echo "filed";
    }
} else {
    echo "filed";
}
