Google
Edit File: authenticate.php
<?php session_start(); include "db.php"; if($_SERVER['REQUEST_METHOD'] !== 'POST'){ die("Invalid request"); } $email = $_POST['email']; $password = $_POST['password']; $stmt = $conn->prepare("SELECT * FROM admins WHERE email=?"); $stmt->bind_param("s",$email); $stmt->execute(); $user = $stmt->get_result()->fetch_assoc(); if($user && password_verify($password, $user['password'])){ session_regenerate_id(true); // 🔥 prevents session hijacking $_SESSION['admin'] = $user['id']; header("Location: dashboard"); exit; }else{ echo "Invalid login credentials."; }