auth_process.php

<?php 
session_start();
require_once 'config.php';

// Initialize alerts array if not exists
if (!isset($_SESSION['alerts'])) {
    $_SESSION['alerts'] = [];
}

// --- REGISTRATION LOGIC ---
if (isset($_POST['register_btn'])) {
    $name = trim($_POST['name']);
    $email = trim($_POST['email']);
    $password = password_hash($_POST['password'], PASSWORD_DEFAULT);

    // 1. Check if email already exists using a Prepared Statement
    $stmt = $conn->prepare("SELECT email FROM users WHERE email = ?");
    $stmt->bind_param("s", $email);
    $stmt->execute();
    $result = $stmt->get_result();

    if ($result->num_rows > 0) {
        $_SESSION['alerts'][] = [
            'type' => 'error',
            'message' => 'This email is already registered!'
        ];
        $_SESSION['active_form'] = 'register';
    } else {
        // 2. Insert new user safely
        $insert_stmt = $conn->prepare("INSERT INTO users (name, email, password) VALUES (?, ?, ?)");
        $insert_stmt->bind_param("sss", $name, $email, $password);
        
        if ($insert_stmt->execute()) {
            $_SESSION['alerts'][] = [
                'type' => 'success',
                'message' => 'Registration successful! Please login.'
            ];
            $_SESSION['active_form'] = 'login';
        } else {
            $_SESSION['alerts'][] = [
                'type' => 'error',
                'message' => 'Something went wrong. Please try again.'
            ];
        }
        $insert_stmt->close();
    }
    $stmt->close();
    header('Location: index.php');
    exit();
}

// --- LOGIN LOGIC ---
if (isset($_POST['login_btn'])) {
    $email = trim($_POST['email']);
    $password = $_POST['password'];

    // 3. Select user safely using a Prepared Statement
    $stmt = $conn->prepare("SELECT * FROM users WHERE email = ?");
    $stmt->bind_param("s", $email);
    $stmt->execute();
    $result = $stmt->get_result();
    
    if ($result->num_rows > 0) {
        $user = $result->fetch_assoc();
        
        // 4. Verify the hashed password
        if (password_verify($password, $user['password'])) {
            $_SESSION['name'] = $user['name'];
            $_SESSION['alerts'][] = [
                'type' => 'success',
                'message' => 'Welcome back, ' . $user['name'] . '!'
            ];
            unset($_SESSION['active_form']); // Hide the modal
        } else {
            $_SESSION['alerts'][] = [
                'type' => 'error',
                'message' => 'Incorrect password!'
            ];
            $_SESSION['active_form'] = 'login';
        }
    } else {
        $_SESSION['alerts'][] = [
            'type' => 'error',
            'message' => 'No account found with that email.'
        ];
        $_SESSION['active_form'] = 'login';
    }
    
    $stmt->close();
    header('Location: index.php');
    exit();
}
?>