prepare($sql); if ($stmt) { $stmt->bind_param("ssssss", $user, $ip, $os, $browser, $thistime, $status); $stmt->execute(); $stmt->close(); } } catch (Exception $e) { // Ignore logging errors so they don't break the login flow error_log("Login Auth Log Error: " . $e->getMessage()); } } try { //------- Check Block IP ---------- $stmt_block = $conn2->prepare("SELECT block_ip_number FROM block_ip WHERE block_ip_number = ?"); $stmt_block->bind_param("s", $ip); $stmt_block->execute(); $stmt_block->store_result(); if ($stmt_block->num_rows >= 1) { $stmt_block->close(); echo '

Your IP is Blocked !!!

'; exit(); } $stmt_block->close(); //------- Check User Credentials ---------- $stmt_user = $conn1->prepare("SELECT loginname, name, entryposition, two_fa_secret_key_samui FROM opduser WHERE loginname = ? AND passweb = ? AND two_fa_secret_key_samui IS NOT NULL AND account_disable='N'"); $stmt_user->bind_param("ss", $user, $md5_pass); $stmt_user->execute(); $result_user = $stmt_user->get_result(); if ($result_user->num_rows === 1) { $row = $result_user->fetch_assoc(); $account = $row['loginname']; $name = $row['name']; $position = $row['entryposition']; $fa_secretkey = $row['two_fa_secret_key_samui']; if (TokenAuth6238::verify($fa_secretkey, $currentcode)) { session_regenerate_id(true); // Prevent session fixation $_SESSION['sess_userid'] = session_id(); $_SESSION['account'] = $account; $_SESSION['name'] = $name; $_SESSION['position'] = $position; $_SESSION['ip'] = $ip; log_auth($conn2, $user, $ip, $os, $browser, $thistime, "Login Success"); header("Location: main.php"); exit(); } else { log_auth($conn2, $user, $ip, $os, $browser, $thistime, "2FA Authen Fail"); header("Location: error.php?message=Pass+Code"); exit(); } } else { log_auth($conn2, $user, $ip, $os, $browser, $thistime, "User/Pass Fail"); header("Location: error.php?message=" . urlencode("บัญชีผู้ใช้ / รหัสผ่าน")); exit(); } } catch (Exception $e) { // If something crashes completely, show error error_log("Authen Error: " . $e->getMessage()); header("Location: error.php?message=" . urlencode("ระบบฐานข้อมูลขัดข้อง")); exit(); } ?>