<?php
session_start();

include("../config/db.php");
include("../config/config.php"); // BASE_URL

// Get form data safely
$username = $_POST['username'] ?? '';
$password = $_POST['password'] ?? '';

// Basic validation
if (empty($username) || empty($password)) {
    echo "Please enter username and password";
    exit;
}

// Encrypt password
$password = md5($password);

// Query
$stmt = $conn->prepare("SELECT * FROM super_admin WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();

if ($result->num_rows > 0) {
    $_SESSION['admin'] = $username;

    // ✅ Correct redirect using BASE_URL
    header("Location: " . BASE_URL . "dashboard.php");
    exit;

} else {
    echo "<script>alert('Invalid Login'); window.location.href='" . BASE_URL . "auth/login.php';</script>";
}
?>