8192) { $errors['key'] = 'Invalid keyfile.'; } else { $content = @file_get_contents($_FILES['keyfile']['tmp_name']); $raw_key = $content !== false ? parse_login_key($content) : ''; } } // Fallback: pasted key text if (!$errors && $raw_key === '') { $pasted = trim($_POST['keytext'] ?? ''); $raw_key = $pasted !== '' ? parse_login_key($pasted) : ''; } if (!$errors && $raw_key === '') { $errors['key'] = 'No valid keyfile or key provided.'; } if (!$errors) { $key_hash = hash('sha256', $raw_key); $s = $pdo->prepare('SELECT * FROM customers WHERE login_key_hash=? AND active=1'); $s->execute([$key_hash]); $cust = $s->fetch(); if ($cust) { session_regenerate_id(true); $_SESSION['customer_id'] = $cust['id']; if (!empty($_POST['remember'])) remember_me_set($cust['id']); $pdo->prepare('UPDATE customers SET last_login=NOW() WHERE id=?')->execute([$cust['id']]); redirect('/account'); } $errors['key'] = 'Key not recognised or account disabled.'; } $method = 'key'; } else { // ---- Username + password login ---- if (rate_limit('login', 8, 600)) { $errors['username'] = 'Too many attempts. Please wait a few minutes.'; } $username = trim($_POST['username'] ?? ''); $pass = $_POST['password'] ?? ''; if (!$errors && $username === '') $errors['username'] = 'Username required.'; if (!$errors && $pass === '') $errors['password'] = 'Password required.'; if (!$errors) { $s = $pdo->prepare('SELECT * FROM customers WHERE username=? AND active=1'); $s->execute([strtolower($username)]); $cust = $s->fetch(); if ($cust && password_verify($pass, $cust['password_hash'])) { session_regenerate_id(true); $_SESSION['customer_id'] = $cust['id']; if (!empty($_POST['remember'])) remember_me_set($cust['id']); $pdo->prepare('UPDATE customers SET last_login=NOW() WHERE id=?')->execute([$cust['id']]); redirect('/account'); } $errors['username'] = 'Invalid username or password.'; } $method = 'password'; } } $page_title = 'Sign in'; require __DIR__ . '/includes/header.php'; ?>

Sign in

Username & password 🔑 Login keyfile