-- e-Train 2026 migration. BACK UP THE DATABASE FIRST (phpMyAdmin > Export).
-- Run in phpMyAdmin on database kpkktcom_etrain BEFORE uploading the new code.

-- 1) Passwords are now stored as hashes (60+ chars); the old column only held 20.
ALTER TABLE `users` MODIFY `userPass` VARCHAR(255) NULL;

-- 2) Login throttling (5 failed attempts / 15 minutes per user or IP).
CREATE TABLE IF NOT EXISTS `login_attempts` (
  `id`     INT UNSIGNED NOT NULL AUTO_INCREMENT,
  `userID` VARCHAR(10)  NOT NULL,
  `ip`     VARCHAR(45)  NOT NULL,
  `okay`   TINYINT(1)   NOT NULL DEFAULT 0,
  `at`     DATETIME     NOT NULL,
  PRIMARY KEY (`id`),
  KEY `k_user` (`userID`, `okay`, `at`),
  KEY `k_ip`   (`ip`, `okay`, `at`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

-- 3) OPTIONAL, recommended: stop duplicate users. First check this returns no rows:
--    SELECT userCoy, userID, COUNT(*) FROM users GROUP BY userCoy, userID HAVING COUNT(*) > 1;
-- ALTER TABLE `users` ADD UNIQUE KEY `u_user` (`userCoy`, `userID`);