Member Login - <?php echo BRAND

900) { $_SESSION['login_attempts'] = 0; } // Block if too many attempts if ($_SESSION['login_attempts'] >= 5) { $time_remaining = 900 - (time() - $_SESSION['last_attempt_time']); if ($time_remaining > 0) { $minutes = ceil($time_remaining / 60); $error = "Too many failed login attempts. Please try again in {$minutes} minute(s)."; // Log blocked attempt try { $pdo_log = new PDO("mysql:host=" . DB_HOST . ";dbname=" . DB_NAME, DB_USER, DB_PASS); $pdo_log->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); log_security_event($pdo_log, 'login_blocked', $_POST['username'] ?? 'unknown', "Blocked due to rate limiting. {$_SESSION['login_attempts']} attempts."); $pdo_log = null; } catch (PDOException $e) { // Silently fail if logging doesn't work } } else { $_SESSION['login_attempts'] = 0; } } // Handle login form submission if ($_SERVER['REQUEST_METHOD'] === 'POST' && (!isset($error))) { $username = trim($_POST['username']); $password = $_POST['password']; if (empty($username) || empty($password)) { $error = 'Please enter both username and password.'; } else { try { $pdo = new PDO("mysql:host=" . DB_HOST . ";dbname=" . DB_NAME, DB_USER, DB_PASS); $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // Query for any user (admin or regular member) $stmt = $pdo->prepare("SELECT * FROM members WHERE username = ?"); $stmt->execute([$username]); $user = $stmt->fetch(PDO::FETCH_ASSOC); if ($user && password_verify($password, $user['password']) && !$user['suspended']) { // Check if email is verified (admins bypass this check) if (!$user['is_admin'] && !$user['email_verified']) { $_SESSION['login_attempts']++; $_SESSION['last_attempt_time'] = time(); log_security_event($pdo, 'login_failed', $username, "Email not verified"); $error = 'Please verify your email address before logging in. Check your inbox for the verification link or resend verification email.'; } else { // Update last access time and last login IP $client_ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown'; $updateStmt = $pdo->prepare("UPDATE members SET last_access = NOW(), last_login_ip = ? WHERE id = ?"); $updateStmt->execute([$client_ip, $user['id']]); // Determine user type for logging $user_type = $user['is_admin'] ? 'admin' : 'member'; // Log successful login log_security_event($pdo, 'login_success', $username, "{$user_type} login successful"); // Regenerate session ID to prevent session fixation session_regenerate_id(true); // Reset login attempts on successful login $_SESSION['login_attempts'] = 0; // Set session variables $_SESSION['user_logged_in'] = true; $_SESSION['username'] = $username; $_SESSION['user_id'] = $user['id']; $_SESSION['is_admin'] = (bool)$user['is_admin']; $_SESSION['user_ip'] = $_SERVER['REMOTE_ADDR']; $_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT']; $_SESSION['user_name'] = $user['firstName'] . ' ' . $user['lastName']; $_SESSION['last_activity'] = time(); // Redirect to dashboard header('Location: dashboard.php'); exit; } } elseif ($user && $user['suspended']) { $_SESSION['login_attempts']++; $_SESSION['last_attempt_time'] = time(); log_security_event($pdo, 'login_failed', $username, "Account suspended"); $error = 'Account suspended. Please contact an administrator.'; } else { $_SESSION['login_attempts']++; $_SESSION['last_attempt_time'] = time(); log_security_event($pdo, 'login_failed', $username, "Invalid credentials"); $error = 'Invalid username or password.'; } } catch (PDOException $e) { $error = 'Database connection error. Please try again later.'; } } } // Generate Google OAuth state for CSRF protection if (!isset($_SESSION['oauth_state'])) { $_SESSION['oauth_state'] = bin2hex(random_bytes(32)); } $google_oauth_available = !empty($GOOGLE_OAUTH_ENABLED) && function_exists('getGoogleAuthUrl'); $google_auth_url = ''; if ($google_oauth_available) { $google_auth_url = getGoogleAuthUrl(GOOGLE_REDIRECT_LOGIN, $_SESSION['oauth_state']); } ?> Member Login - <?php echo BRAND_NAME; ?>

AI-Powered Fantasy Creation

Welcome Back