prepare("
SELECT
id,
name,
phone,
password_hash,
role,
created_at,
verify_code,
status,
COALESCE(session_version, 0) AS session_version,
COALESCE(balance, 0) AS balance
FROM users
WHERE phone = :phone
LIMIT 1
");
$stmt->execute([':phone' => $phoneNorm]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);
if (!$user) {
$errors[] = __('page.login.error.user_not_found');
} else {
$hash = (string)($user['password_hash'] ?? '');
if ($hash === '' || !password_verify($password, $hash)) {
$errors[] = __('page.login.error.wrong_password');
} elseif (($user['status'] ?? '') === 'blocked') {
$errors[] = __('page.login.error.blocked');
} else {
session_regenerate_id(true);
$_SESSION['user'] = [
'id' => (int)$user['id'],
'name' => $user['name'] ?? '',
'phone' => $user['phone'] ?? '',
'role' => $user['role'] ?? 'user',
'created_at' => $user['created_at'] ?? null,
'verify_code' => $user['verify_code'] ?? null,
'status' => $user['status'] ?? null,
'session_version' => (int)($user['session_version'] ?? 0),
'balance' => (float)($user['balance'] ?? 0),
'is_superadmin' => (($user['role'] ?? '') === 'superadmin') ? 1 : 0,
];
header('Location: ' . mhk_url(''));
exit;
}
}
}
}
?>
<?= htmlspecialchars(__('page.login.title')) ?>