<?php
  include("database.php");
  $email = "";

  session_start();
  if (isset($_SESSION["sid"]) && isset($_SESSION["sname"])) {
    header("Location: index.php");
    exit();
  } elseif (isset($_POST["submit"])) {
    $email = trim($_POST["myemail"]);
    $pass = $_POST["mypass"];

    if (filter_input(INPUT_POST, "myemail", FILTER_VALIDATE_EMAIL) && strlen($pass) > 3) {
      $safeEmail = mysqli_real_escape_string($connection, $email);
      $query = "SELECT id, name, password FROM users WHERE email = '$safeEmail'";
      $result = mysqli_query($connection, $query);
      $user = mysqli_fetch_assoc($result);

      if ($user && password_verify($pass, $user["password"])) {
        session_regenerate_id(true);
        $_SESSION["sid"] = $user["id"];
        $_SESSION["sname"] = $user["name"];

        header("Location: index.php");
        exit();
      }
    }
  }
?>
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Sign In</title>
</head>
<body>
  <section>
    <form name="myform" method="post" action="signin.php">
      <p>Access Account</p>
      <p>
        <label for="myemail">Email: </label>
        <input type="email" id="myemail" name="myemail" value="<?php echo htmlspecialchars($email);?>">
      </p>
      <p>
        <label for="mypass">Password: </label>
        <input type="password" id="mypass" name="mypass">
      </p>
      <input type="submit" name="submit" value="Sign In">
    </form>
  </section>
</body>
</html>