admin.php:
<?php
session_start();
// Original PHP code by Chirp Internet: www.chirp.com.au
// Please acknowledge use of this code by including this header.
function better_crypt($input, $rounds = 10)
{
$crypt_options = array(
'cost' => $rounds
);
return password_hash($input, PASSWORD_BCRYPT, $crypt_options);
}
if(isset($_SESSION['logged_in'])){
//display index
}else{
// display login
if(isset($_POST['username'], $_POST['password'])){
$username = $_POST['username'];
$password = better_crypt($_POST['password'], 10);
if(empty($username) or empty($password)){
$error = 'All field are required!';
}else{
$query = $pdo->prepare("SELECT * FROM users WHERE user_name = ?");
$query->bindValue(1, $username);
$query->execute();
$user = $query->fetch();
if(password_verify($_POST['password'],$user['user_password'])){
$_SESSION['user'] = $user['user_password'];
$_SESSION['password'] = $_POST['password'];
}else{
$error = 'Please enter correct username and password' . 'password: ' . $password;
}
}
}
}
?>
blog-post.php:
De query wordt goed uitgevoerd, maar ik weet niet of het checken van het wachtwoord nu ook lukt aangezien er niks in de sessie staat waarschijnlijk.
<?php
session_start();
if(isset($_GET['id'])){
// display the blogpost
$id = $_GET['id'];
$data = $blogpost->fetch_data($id);
$comments = $comment->fetch_comment($id);
}else{
header('Location: ../index.php');
exit();
}
if(isset($_SESSION['logged_in'])){
if(isset($_SESSION['username'], $_SESSION['password'])){
$username = $_POST['username'];
$password = better_crypt($_POST['password'], 10);
if(empty($username) or empty($password)){
$error = 'All field are required!';
}else{
$query = $pdo->prepare("SELECT * FROM users WHERE user_name = ?");
$query->bindValue(1, $username);
$query->execute();
$user = $query->fetch();
if(password_verify($_SESSION['password'],$_SESSION['user_password'])){
if(isset($_GET['id'], $_POST['blog_post_author'], $_POST['blog_post_title'], $_POST['blog_post_small_content'], $_POST['blog_post_content'], $_POST['blog_post_lead'])){
global $pdo;
$query = $pdo->prepare("UPDATE blog_posts SET blog_post_author = ?, blog_post_title = ?, blog_post_small_content = ?, blog_post_content = ?, blog_post_lead = ? WHERE blog_post_id = ?");
$query->bindValue(1, $_POST['blog_post_author']);
$query->bindValue(2, $_POST['blog_post_title']);
$query->bindValue(3, $_POST['blog_post_small_content']);
$query->bindValue(4, $_POST['blog_post_content']);
$query->bindValue(5, $_POST['blog_post_lead']);
$query->bindValue(6, $_GET['id']);
$result = $query->execute();
}
}else{
$error = 'Please enter correct username and password' . 'password: ' . $password;
}
}
}
}else{
// display login
if(isset($_SESSION['username'], $_SESSION['password'])){
$username = $_SESSION['username'];
$password = better_crypt($_SESSION['password'], 10);
if(empty($username) or empty($password)){
$error = 'All field are required!';
}else{
$query = $pdo->prepare("SELECT * FROM users WHERE user_name = ?");
$query->bindValue(1, $username);
$query->execute();
$user = $query->fetch();
if(password_verify($_SESSION['password'],$_SESSION['user_password'])){
if(isset($_GET['id'], $_POST['blog_post_author'], $_POST['blog_post_title'], $_POST['blog_post_small_content'], $_POST['blog_post_content'], $_POST['blog_post_lead'])){
global $pdo;
$query = $pdo->prepare("UPDATE blog_posts SET blog_post_author = ?, blog_post_title = ?, blog_post_small_content = ?, blog_post_content = ?, blog_post_lead = ? WHERE blog_post_id = ?");
$query->bindValue(1, $_POST['blog_post_author']);
$query->bindValue(2, $_POST['blog_post_title']);
$query->bindValue(3, $_POST['blog_post_small_content']);
$query->bindValue(4, $_POST['blog_post_content']);
$query->bindValue(5, $_POST['blog_post_lead']);
$query->bindValue(6, $_GET['id']);
$result = $query->execute();
}
}else{
$error = 'Please enter correct username and password' . 'password: ' . $password;
}
}
}
}
