<form> ... </form><?php
## Wees er zeker van dat de pagina waar je het wilt laten weergeven een .PHP bestand is. ##
// Verander voorbeeld naar jouw behoren. Bijvoorbeeld username / gebruikersnaam oid
$gebruikersnaam = $_POST['voorbeeld'];
print "Aangemeld als:".$gebruikersnaam.".";
?><?php
## Wees er zeker van dat de pagina waar je het wilt laten weergeven een .PHP bestand is. ##
// Verander voorbeeld naar jouw behoren. Bijvoorbeeld username / gebruikersnaam oid
print "Aangemeld als:".$_POST['voorbeeld'].".";
?><?php
ob_start();
$host="***"; // Host name
$username="***"; // Mysql username
$password="***"; // Mysql password
$db_name="***"; // Database name
$tbl_name="***"; // Table name
// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("CAN NOT CONNECT. TRY LATER AGAIN.");
mysql_select_db("$db_name")or die("cannot select DB");
// Define $myusername and $mypassword
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1){
// Register $myusername, $mypassword and redirect to file "welcome.html"
session_register("myusername");
session_register("mypassword");
header("location:welcome.html");
}
else {
echo 'Fout wachtwoord of gebruikersnaam.';
}
ob_end_flush();
?>
<div style="position: absolute; left: -200px; top: -200px;">
<input type="text" name="funname" id="funname" size="40" value="" />
</div><?php
ob_start();
$host="***"; // Host name
$username="***"; // Mysql username
$password="***"; // Mysql password
$db_name="***"; // Database name
$tbl_name="***"; // Table name
// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("CAN NOT CONNECT. TRY LATER AGAIN.");
mysql_select_db("$db_name")or die("cannot select DB");
if(isset($_GET['mode'])){
if($_GET['mode']=='post'){
//dit is een post
//nakijken of de dummy is ingevuld, is dat het geval, dan is dat een hack!
if(trim($_POST['funname'])!=''){
disconnectfromdb();
//het is een hack! we sturen hem terug naar de login.php
echo '<meta http-equiv="refresh" content="0;url=login.php" />';
}else{
//ok, geen hack, we kunnen verder!
// Define $myusername and $mypassword
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1){
// Register $myusername, $mypassword and redirect to file "welcome.html"
session_register("myusername");
session_register("mypassword");
header("location:welcome.html");
}
else {
echo 'Fout wachtwoord of gebruikersnaam.';
}
ob_end_flush();
?><?php
//ob_start();
$host="***"; // Host name
$username="***"; // Mysql username
$password="***"; // Mysql password
$db_name="***"; // Database name
$tbl_name="***"; // Table name
// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("CAN NOT CONNECT. TRY LATER AGAIN.");
mysql_select_db("$db_name")or die("cannot select DB");
// Define $myusername and $mypassword
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$mypassword = illegalcharconverter($mypassword);
$myusername = illegalcharconverter($myusername);
if(is_name($myusername)){die("YOUR SERIUS ABOUT YOUR NAME,I THINK IT SO!");}//save and remove this person is hacker behalve als email = username
if(is_sqlinject($mypassword)){die("DO NOT INJECT ME, O SORRY I DIEEEEEEEE !");}
if(is_sqlinject($myusername)){die("DO NOT INJECT ME, O SORRY I DIEEEEEEEE !");}
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1){
// Register $myusername, $mypassword and redirect to file "welcome.html"
session_register("myusername");
session_register("mypassword");
header("location:welcome.php");//******************************************
}else {
echo 'Fout wachtwoord of gebruikersnaam.';
}
$password=null;//*******************************************
//ob_end_flush();
function illegalcharconverter($str){
$chars=array("&" ,"<" , ">" ,"!" ,'"' ,"," ,"$" ,"'" ,"*" ,"+" );
$ascii=array("&","<", ">","!",""",",","$","'","*","+");
return str_replace($chars,$ascii , $str);
}
function is_sqlinject($var){//DROP TABLE
return pos($var,"DROP TABLE")||pos($var,"DROP ")||(pos($var," WHERE ") && pos($var," OR "))||pos($var,"SELECT * FROM");
}
function is_name($var){
return (is_avowel($var,5));//not posible name =>5 =>"schr"
}
function is_avowel($var,$max){
$max =($max<1)?5:$max;
for ($i = 0; $i < $max; $i++) {
switch($arr[$i]):
case "a":
case "e":
case "i":
case "o":
case "u":
return true;
break;
endswitch;
}
return false;
}
?>
