<?php session_start(); 

//強制使用HTTPS來登入
if (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on') {
    if(!headers_sent()) {
        header("Status: 301 Moved Permanently");
        header(sprintf(
            'Location: https://%s%s',
            $_SERVER['HTTP_HOST'],
            $_SERVER['REQUEST_URL']
        ));
        exit();

    }
}
if (!isset($_GET['lang']) && !isset($_POST['lang'])){
	$_SESSION['lang'] = "chi";
	$lang = "chi";
} else {
	if ((isset($_GET['lang']) && $_GET['lang']  == "chi" )|| (isset($_POST['lang']) && $_POST['lang'] =="chi")) {
		$_SESSION['lang'] = "chi";
		$lang="chi";
	} else {
		$_SESSION['lang'] = "en";
		$lang = "en";
	}
}


require "spconfig.php";  
if ($_SESSION['lang'] == "chi"){
	require "language/chi.php";
} else {
	require "language/eng.php";
}

$sql= mysqli_query($splink,"Select SCHYEAR from SCHYEAR where activeyear=\"1\"");
while ($row = mysqli_fetch_row($sql)){
	$todayschyr = $row[0];
}


?>
<html>
<head>
<!--[if lt IE 9]>
<link rel='stylesheet' type="text/css" href='css/normal.css'>
<![endif]-->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link rel='stylesheet' media='screen and (max-width: 700px)' type="text/css" href='css/small.css'>
<link rel='stylesheet' media='screen and (min-width: 701px) and (max-width: 900px)' type="text/css" href='css/medium.css'>
<link rel='stylesheet' media='screen and (min-width: 901px)' type="text/css" href='css/normal.css'>

<meta name="viewport" content="width=device-width, initial-scale=1">
<title><?php echo $company. " ".$txtsystemtitle; ?></title>

</head>

<body>
<div style=" position:relative; text-align:center" id="logo"></div>
<div id="underlogo" style="position:relative"><p align="center"><img src="img/logo_700_109.jpg"><br>
<?php 
  if ($_SESSION['lang'] == "chi"){
	  ?>
      <a href="?lang=en">English</a><br>
      <?php
  } else {
	  ?>
      <a href="?lang=chi">中文</a><br>
      <?php 
 }

 ?>
</p>
<?php

if (isset($_POST["LOGIN"])){
	$UID = $_POST["UID"]; //get UID from the login form
	$UID = strtolower($UID);
	$sql = mysqli_query($splink,"Select status from loginfaillock where UID=\"".$UID."\"");
	if (mysqli_num_rows($sql) > 0 ) {
		while ($row=mysqli_fetch_row($sql)) {
			if ($row[0] == "1" ) {
				$enablelogin = 0;
			} else {
				$enablelogin = 1;
			}
		}
	} else {
	  //no login lock record
	  $enablelogin= 1;
	}
	if (isset($_SESSION['staff'])){
		unset($_SESSION['staff']);  
	}
	if (isset($SESSION['student'])){
		unset($_SESSION['student']);
	}
	if ($enablelogin == 1) {
		
		$password = $_POST["password"];
		if (substr($UID,0,1) == "s" ) {   //學生登入名稱必需s字頭
			//學生登入
			$UID = substr($UID,1);
			$login = mysqli_query($splink,"Select password from TB_STU_STUDENT where REGNO=\"".$UID."\"");
			$URL = "sportday.php";
			$_SESSION['URL'] = $URL;
			while ($row = mysqli_fetch_row($login)){
				$sqlpassword = $row[0];
				$sql = mysqli_query($splink,"Select REGNO, CHNAME, ENNAME, CLASSCODE, CLASSNO, STUID from studentinfo where REGNO=\"".$UID."\"");
				while ($srow = mysqli_fetch_row($sql)){
				$sqlcode = $srow[0];
				$_SESSION['CH_NAME'] = $srow[1];
				$_SESSION['EN_NAME'] = $srow[2];
				$_SESSION['CLASSCODE'] = $srow[3];
				$_SESSION['CLASSNO'] = $srow[4];
				$_SESSION['STUID'] = $srow[5];
				}
				$_SESSION['role']=2;
				$_SESSION['lang']=$lang;
			}
			mysqli_free_result($login);
		}
		if (substr($UID,0,1) =="t") { //老師登入名稱必需t字頭
		
			//老師登入
			$checkrole = substr($UID,0,1);
			$login = mysqli_query($splink,"Select STAFFUID, password, STAFFCODE, CH_NAME, EN_NAME from teacherinfo where STAFFUID=\"".$UID."\"");
			$URL = "sportday.php";
			$_SESSION['URL'] = $URL;
			while ($row = mysqli_fetch_row($login)){
				$sqlcode =$row[0];
				$sqlpassword = $row[1];
				$_SESSION['STAFFCODE'] =$row[2];
				$_SESSION['CH_NAME'] =$row[3];
				$_SESSION['EN_NAME'] = $row[4];
				$_SESSION['lang']=$lang;
				if ($checkrole == "t") {
					$_SESSION['role'] = 1;
				} else if ($checkrole =="c"){
						$_SESSION['role'] = 1;
				} else {
					$_SESSION['role'] = 3;
				}
			}
			mysqli_free_result($login);
		}
  //判斷帳號與密碼是否為空白
  //以及MySQL資料庫裡是否有這個會員
		if (!isset($sqlcode)){
			$sqlcode = "";
		}
		if (!isset($sqlpassword)){
			$sqlpassword="";
		}
		if (password_verify('1234', $sqlpassword)) {
			echo "haha";
		} else {
			echo "sosad";
		}

		if( $UID != null && $password != null && $sqlcode == $UID && password_verify($password, $sqlpassword)) {
		//將帳號寫入session，方便驗證使用者身份
			$_SESSION['UID'] = $sqlcode;
			echo "<br><br><br><p align=\"center\">".$txtloginsucess1.$URL.$txtloginsucess2."</p><br>";
			echo '<meta http-equiv=REFRESH CONTENT=0;url='.$URL.'>';
		} else {
			echo "<p align=\"center\">".$txtloginfail."<br></p>";

		}
	} else {
		echo "<br><br><p align=\"center\">".$txtyouraccountisbelogedcontacttheadmin."<br></p><br>";
	}
?>

<?php 
}
echo "<br><br><br><p align=\"center\">".$txtloginsucess1.$URL.$txtloginsucess2."</p><br>";
?>

   <div class="loginbox" id="loginbox"><p align="center"><strong><?=$txtwelcome?></strong></p><p>
   
    <form action="index.php" method="post" name="loginform"><input type="hidden" name="lang" value="<?=$lang?>">
    <table border="0" cellspacing="0" cellpadding="0" align="center">
      <tr>
        <td align="center" valign="middle"><?=$txtuid?>：</td>
        <td align="center" valign="middle"><input type="text" name="UID" size="15" height="20"><br></td>
        <td align="center" valign="middle"></td>
      </tr>
      <tr>
        <td align="center" valign="middle"><?=$txtpassword?>：</td>
        <td align="center" valign="middle"><input name="password" type="password" size="15" height="20"></td>
        <td align="center" valign="middle"><input type="submit" name="LOGIN" value="<?=$txtlogin?>"></td>
      </tr>
    </table>
</form>
</div>
</div>
<div class="logindown" id="logindown"><p align="center">請勿使用Internet Explorer 8, 請使用 Internet Explorer 9+,FireFox, Chrome, safari 或其他瀏覽器<br>
   Please USE Internet Explorer 9+, FireFox, Chrome , safari or other browser. Don't Use Internet Explorer 8.</p></div>

</body>
</html>
