<?php
session_start();

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    include('connection.php');

    $username = $_POST["username"];
    $password = $_POST["password"];

    // Vulnerable to SQL injection; not recommended for production
    $sql = "SELECT username, password FROM hr_login WHERE username = '$username' AND password = '$password'";
    $result = $conn->query($sql);

    if ($result->num_rows > 0) {
        $_SESSION["username"] = $username;
        header("Location: index.php?success=Login Successfully!!!");
        exit();
    } else {
        header("Location: index.php?error=Invalid username or password");
        exit();
    }

    $conn->close();
}
?>
