<?php
require 'db.php';

$email = $_POST['email'];
$pass  = $_POST['password'];

$q = $conn->prepare("SELECT * FROM usuarios WHERE email=?");
$q->bind_param("s", $email);
$q->execute();
$user = $q->get_result()->fetch_assoc();

if ($user && password_verify($pass, $user['password'])) {
  $_SESSION['user'] = $user;
  if ($user['rol'] == 'admin')
    header("Location: admin/panel.php");
  else
    header("Location: usuario/cartas.php");
} else {
  echo "Login incorrecto";
}
