The following files exists in this folder. Click to view.
Foogler_blog/pages/login
PLogin.php
PLoginProcess.php
PLogoutProcess.php
<?php
//------------------
//PLoginProcess.php
//
//Performs the login process
//------------------
//--------------------------
//Gets POST values
$user = isset($_POST['username'])? $_POST['username'] : '';
$password = isset($_POST['password']) ? $_POST['password'] : '';
// -------------------------
// Destroy the current session (logout user), if it exists.
require_once(TP_SOURCEPATH . 'FDestroySession.php');
//--------------------------
//DB stuff
$mysqli = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_DATABASE); //New DB object
//Makes sure DB connection worked
if (mysqli_connect_error()) {
echo "Connect failed: ".mysqli_connect_error()."<br>";
exit();
}
$mysqli->set_charset("utf8");
//Prevent SQL injections
$user = $mysqli->real_escape_string($user);
$password = $mysqli->real_escape_string($password);
// ---------------------------------------------------------------------------
// SQL query.
$tableAuthor = DB_PREFIX . 'Author';
$query = <<<EOD
--
-- Gets username and user id
--
SELECT
idAuthor,
username
FROM {$tableAuthor}
WHERE
username = '{$user}' AND
password = md5('{$password}');
EOD;
$res = $mysqli->query($query) or die("<p>Could not query database,</p><code>{$query}</code>"); //Performs query
// --------------------------
// Use the results of the query to populate a session that shows we are logged in
session_start(); // Must call it since we destroyed it above.
session_regenerate_id(); // To avoid problems
$row = $res->fetch_object(); //Gets results
// Must be one row in the resultset
if($res->num_rows === 1) {
//Sets user info to session
$_SESSION['accountId'] = $row->idAuthor;
$_SESSION['accountUser'] = $row->username;
} else {
//Sets error message and returns to login page
$_SESSION['errorMessage'] = "Inloggningen misslyckades";
$_POST['redirect'] = 'login';
}
$res->close();
$mysqli->close(); //Closes DB connection
// -------------------------------
// Redirect to another page
$redirect = isset($_POST['redirect']) ? $_POST['redirect'] : 'home';
$redirect = ($redirect == 'login') ? 'home' : $redirect; //If login page then change to home page
header('Location: ' . WS_SITELINK . "?p={$redirect}");
exit;
?>