<?php
require_once('include/config.php');
session_start();

// --- 1. 修复逻辑：取消注释，只有当 act=login 时才执行登录验证 ---
if (isset($_GET['act']) && $_GET['act'] == 'login') {
    
    // --- 2. 修复安全：使用 isset() 防止未定义索引 ---
    // 如果表单字段不存在，赋值为空字符串，避免报错
    $username = isset($_POST['username']) ? $_POST['username'] : '';
    $password = isset($_POST['pwd']) ? md5($_POST['pwd']) : ''; 

    // 防止SQL注入（虽然简单，但比直接拼接好）
    $username = mysqli_real_escape_string($db, $username);

    $exec = "SELECT * FROM admin WHERE username='$username'";
    
    if ($result = mysqli_query($db, $exec)) {
        if ($rs = mysqli_fetch_object($result)) {
            if ($rs->password == $password) {
                $_SESSION['admin_name'] = $username;
                $_SESSION['style'] = $rs->style;
                header("location:index.php");
                exit; // 跳转后强制退出，防止后续代码执行
            } else {
                echo "<script>alert('密码不正确!');window.history.back();</script>";
            }
        } else {
            echo "<script>alert('用户名不正确!');window.history.back();</script>";
        }
    } else {
        echo "<script>alert('数据库连接错误!');location.href='admin.php';</script>";
    }
}
// 如果不是登录提交，或者验证失败，脚本会继续执行，显示登录页面（假设下面有HTML）
?>
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
<meta name="apple-mobile-web-app-capable" content="yes" />
<meta name="theme-color" content="#EEEEEE">
<title><?php echo webname.version ?></title>
<link rel="stylesheet" type="text/css" href="include/main.css?20260616" />
<link rel="apple-touch-icon-precomposed" href="../images/touch-icon-new-ipad-admin.png" />
</head>
<body>
  <div class="login_box">
      <form action="admin.php?act=login" method="post" name="login">
      <dl>
      <dd class="logo_top">HELLO, KUN</dd>
      <dd class="box_wz"><input name="username" type="text" class="loginput" id="username" placeholder="用户名" /></dd>
      <dd class="box_wz"><input name="pwd" type="password" class="loginput" id="pwd" placeholder="密码" /></dd>
      <dd class="box_an"><input name="Submit" type="submit" class="admin_botton" value="登 录" /></dd>
      </dl>
      </form>
  </div>
<div class="copyright2">Copyright © 2010 - <script>document.write( new Date().getFullYear() );</script> WKUN.com. All Rights Reserved.</div>
<div class="zhezhao"></div>
</body>
</html>