<?php
	//user defined information
	$udir = "UserDB/";
	$username = $_POST['userID'];
	$enteredpw = $_POST['userPW'];
	$exist = file_exists($udir . $username . ".txt");
	
	//verify user not trying to fuck this shitty web
	$userexploit = isset($username);
	
	if ($exist == true) {
		$filename = $udir . $username . ".txt";
		$file = fopen($filename,"r");
			$readed = fread($file,filesize($filename));
			fclose($file);
		$rearray = explode("\r\n",$readed);

		$hashf = $rearray[0];
	}
	else {
		header("Location: wrong-pass.html");
	}

	//Verify it and tell what to do if
		$pstat = password_verify($enteredpw, $hashf);
		
		if($userexploit) {
			if($pstat == false) {
				header("Location: wrong-pass.html");
			}
		}
		else {
			header("Location: anti-exploit.html");
		}
?>

<!DOCTYPE HTML>
	<head>
		<meta name="viewport" content="width=device-width, initial-scale=1.0">
	</head>
	<body>
		<p>Password is correct! Continue?</p>
		<form action="index.php" method="POST">
		<input type="hidden" name="username" value="<?php echo $username; ?>">
		<input type="submit" value="Login">
		</form>
	</body>
</html>