<?php
session_start();
include "../../connect/db.php";

if (isset($_POST['username'])) {
    // Rate limit: 5 attempts per IP per 15 minutes
    if (!rate_limit_check('admin_login_' . $_SERVER['REMOTE_ADDR'])) {
        echo 'rate_limited';
        exit();
    }

    $username = mysqli_real_escape_string($con, $_POST['username']);
    $password = mysqli_real_escape_string($con, $_POST['pword']);

    // Query admin table for matching credentials
    $sql = mysqli_query($con, "SELECT * FROM admin WHERE username = '$username' AND password = '$password' LIMIT 1");

    if ($sql && mysqli_num_rows($sql) > 0) {
        $row = mysqli_fetch_assoc($sql);
        session_regenerate_id(true);
        $_SESSION['man'] = $row['username'];
        echo "success";
    } else {
        echo "login details incorrect";
    }
}

