01.<?php
02.require 'connectdb.php';
03.
04. $member_username = mysqli_real_escape_String($con,$_POST['username']);
05. $member_password = mysqli_real_escape_String($con,$_POST['password']);
06.
07.
08. $salt = 'tikde78uj4ujuhlaoikiksakeidke';
09. $hash_member_password = hash_hmac('sha256',$member_password,$salt);
10.
11. $sql = "SELECT * FROM tblmember WHERE member_username=? AND member_password=?";
12. $stmt = mysqli_prepare($con,$sql);
13. mysqli_stmt_bind_param($stmt,"ss",$member_username,$hash_member_password);
14. mysqli_execute($stmt);
15. $result_user = mysqli_stmt_get_result($stmt);
16. $row_user = mysqli_fetch_array($result_user,MYSQLI_ASSOC);
17. if(!$row_user)
18. {
19. echo "<script>
20. alert('ชื่อผู้ใช้หรือรหัสผ่านไม่ถูกต้อง');
21. window.location = href='javascript:history.back(1);';
22. </script>";
23. }
24. else
25. {
26. session_start();
27.
28. $_SESSION['member_id'] = $row_user['member_id'];
29. $_SESSION['member_role'] = $row_user['member_role'];
30.
31. if ($row_user["member_role"] == "Admin") {
32. echo "<script>
33. window.location.href='adminindex.php';
34. </script>";
35. }
36. else {
37. echo "<script>
38. window.location.href='memberinfoindex.php';
39. </script>";
40. }
41. }
42. ?>
