<?php require __DIR__ . '/../src/db.php'; session_start();
if($_POST){
    $u = $pdo->prepare("SELECT * FROM users WHERE username=?"); $u->execute([$_POST['u']]); $user = $u->fetch();
    if($user && password_verify($_POST['p'], $user['password_hash'])) { $_SESSION['user_id']=$user['id']; $_SESSION['username']=$user['username']; header('Location: dashboard.php'); exit; }
    $err="Invalid";
}
?>
<!doctype html><link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css" rel="stylesheet">
<div class="container py-5 col-md-4">
    <h3>Login</h3>
    <?php if(!empty($err)) echo "<div class='alert alert-danger'>$err</div>"; ?>
    <form method="post"><input class="form-control mb-2" name="u" placeholder="User"><input class="form-control mb-2" name="p" type="password" placeholder="Pass"><button class="btn btn-primary">Login</button></form>
</div>