<?php
session_start();
require 'db_connect.php';

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $userOrEmail = trim($_POST['user_or_email']);
    $password = $_POST['password'];

    if (empty($userOrEmail) || empty($password)) {
        $_SESSION['error'] = "Please fill all fields.";
        header("Location: login_register.php");
        exit();
    }

    $stmt = $conn->prepare("SELECT * FROM Users WHERE username=? OR email=?");
    $stmt->bind_param("ss", $userOrEmail, $userOrEmail);
    $stmt->execute();
    $result = $stmt->get_result();
    $user = $result->fetch_assoc();

    if ($user && password_verify($password, $user['password_hash'])) {
        $_SESSION['user_id'] = $user['user_id'];
        $_SESSION['username'] = $user['username'];
        header("Location: index2.html");
    } else {
        $_SESSION['error'] = "Invalid username/email or password.";
        header("Location: login_register.php");
    }
}
?>
