<?php
/**
 * cek_login.php - BUG FIXED VERSION
 * Fixes:
 * 1. strpos check corrected to !== false
 * 2. Added mysqli_real_escape_string for SQL safety
 * 3. session_start() before any logic
 */
session_start();
include 'anti.php';
include 'konak.php';

if (!isset($_POST['username'])) { echo "you dont send username"; die(); }
$username = anti_injection($_POST['username']);
if ($username == "") { echo "Empty Username"; die(); }

if (!isset($_POST['password'])) { echo "you dont send Password"; die(); }
$password = anti_injection($_POST['password']);
if ($password == "") { echo "Empty Password"; die(); }

$esUser = mysqli_real_escape_string($koneksi, $username);
$esPass = mysqli_real_escape_string($koneksi, $password);

// FIX: was == true, now !== false
if (strpos($username, '@') !== false) {
    $data = mysqli_query($koneksi, "SELECT * FROM user_id WHERE email='$esUser' AND password='$esPass'");
} else {
    $data = mysqli_query($koneksi, "SELECT * FROM user_id WHERE username='$esUser' AND password='$esPass'");
}

$cek = mysqli_num_rows($data);
if ($cek > 0) {
    $user      = mysqli_fetch_array($data);
    $credit    = $user['cr'];
    $userid    = $user["ID"];
    $username  = $user["username"];
    $usermail  = $user["email"];
    $hwid      = $user["hwid"];
    $lastime   = $user["time"];
    $expired   = $user["expired"];
    $lastlogin = $user["last"];
    $info      = $user["info"];
    $state     = $user["status"];
    $exf       = $user['expired'];

    if (strtotime(date("Y-m-d")) > strtotime($exf)) {
        echo "User expired"; die();
    }
    if (strtotime(date("Y-m-d")) == strtotime($exf)) {
        echo "User new dection"; die();
    }

    echo "ID: "       . $userid    . "\n";
    echo "username: " . $username  . "\n";
    echo "email: "    . $usermail  . "\n";
    echo "password: " . $password  . "\n";
    echo "hwid: "     . $hwid      . "\n";
    echo "time: "     . $lastime   . "\n";
    echo "expired: "  . $expired   . "\n";
    echo "last: "     . $lastlogin . "\n";
    echo "credit: "   . $credit    . "\n";
    echo "info: "     . $info      . "\n";
    echo "state: "    . $state     . "\n";
    echo "status: success";
    die();
} else {
    echo "Failed Username/Email Un registered";
    die();
}
