Dette er 'bare' en login form. Med en tilhørende fil.
Jeg har bare fucked det helt op....
login.php-->
<?php
require_once('login_funcs.inc');
if ($LOGGED_IN = user_isloggedin()) {
user_logout();
$_COOKIE['user_name'] = '';
unset($LOGGED_IN);
}
if( isset($_POST['submit']) && $_POST['submit'] == 'login' ) {
if (strlen($_POST['username']) <= 25 && strlen($_POST['password']) <= 25) {
$feedback = user_login();
}
else {
$feedback = 'ERROR--Username or password are to long';
}
if ($feedback == 1) {
header("location; index.php");
}
else {
$feedback_str = "<P class=\"errormess\">$feedback</P>";
}
}
else {
$feedback_str = '';
}
$php_self = $_SERVER['PHP_SELF'];
$login_form = <<< EOLOGINFORM
<TABLE CELLPADDING=0 CELLSPACING=0 BORDER=0 ALIGN=Center Width=621>
<tr>
<td rowspan=2></td></tr>
<tr>
<td>
$feedback_str
<p class="bold">LOGIN</P>
<form action="$php_self" method="post">
<p class="bold">Username<BR>
<input type="text" name="user_name" value="" size="15" maxlength="20"></p>
<p class="bold">password<br>
<input type="password" name="password" value="" size="15" maxlength="20"></p>
<p><input type="submit" name="submit" value="login"></p>
</form>
</td>
</tr>
</table>
EOLOGINFORM;
echo $login_form;
?>
-------------------------------------------------------------------------------
login_funcs.inc-->
<?php
include_once('db_vars.inc');
$supersecret_hash_padding = 'A string that is used to pad out short strings for md5 encryption';
$LOGGED_IN = false;
unset($LOGGED_IN);
function user_isloggedin() {
global $supersecret_hash_padding, $LOGGED_IN;
if (isSet($LOGGED_IN)) {
return $LOGGED_IN;
}
if (isset($_COOKIE['user_name']) && isset($_COOKIE['id_hash'])) {
$hash = md5($_COOKIE['user_name'].$supersecret_hash_padding);
if ($hash == $_COOKIE['id_hash']) {
return true;
}
else {
return false;
}
}
else {
return false;
}
}
function user_login() {
if (!$_POST['user_name'] || !$_POST['password']) {
$feedback = 'ERROR--Missing username or password';
return $feedback;
}
else {
$user_name = strtolower($_POST['username']);
$password = strtolower($_POST['password']);
$crypt_pwd = md5($password);
$query = "SELECT user_name, is_confirmed
FROM login
WHERE user_name = '$user_name'
AND password='$crypt_pwd'";
$result = mysql_query($query);
if (!$result || mysql_num_rows($result) < 1){
$feedback = 'ERROR--User not found or password incorrect';
return feedback;
}
else {
if (mysql_result($result, 0, 'is_confirmed') == '1') {
user_set_tokens($user_name);
return 1;
}
else {
$feedback = 'ERROR--You may not have confirmed your account yet';
return $feedback;
}
}
}
}
function user_logout() {
setcookie('user_name', '', (time()+2592000), '/', '', 0);
setcookie('id_hash', '', (time()+2592000), '/', '', 0);
}
function user_set_tokens($user_name_in) {
global $supersecret_hash_padding;
if (!$user_name_in) {
$feedback = 'ERROR--No username';
return false;
}
$user_name = strtolower(user_name_in);
$id_hash = md5($user_name.$supersecret_hash_padding);
setcookie('user_name', $user_name, (time()+2592000), '/', '', 0);
setcookie('id_hash', $id_hash, (time()+2592000), '/', '', 0);
}
?>
