package com.example.demo.login;

import com.example.demo.JDBC.ConnectDB;
import com.example.demo.JDBC.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;
import org.springframework.web.util.HtmlUtils;

import javax.servlet.http.HttpSession;

@CrossOrigin
@RestController
@ResponseBody
public class LoginController {

    @Autowired
    UserService userService;

    @PostMapping(value = "/login")
    public Result login(@RequestBody User requestUser, HttpSession session) {
        // 对 html 标签进行转义，防止 XSS 攻击
        String username = requestUser.getUsername();
        username = HtmlUtils.htmlEscape(username);

        String password = requestUser.getPassword();
        password = HtmlUtils.htmlEscape(password);

        ConnectDB connectDB = new ConnectDB();
        String pwd = connectDB.loginSystem(username);

        if (!pwd.equals(password)) {
            String message = "账号密码错误";
            System.out.println(message);
            String a = (String) session.getAttribute("user");
            System.out.println(a);
            return new Result(400);
        } else {
            session.setAttribute("user", username);
            String a = (String) session.getAttribute("user");
            System.out.println(a);
            return new Result(200);
        }

    }
}