//Function to sanitize values received from the form. Prevents SQL injection
function clean($str) {
$str = @trim($str);
if(get_magic_quotes_gpc()) {
$str = stripslashes($str);
}
return mysql_real_escape_string($str);
}
//Start session
if(isset($_POST['email']) && isset($_POST['password1']))
{
require_once('function.php');
//Array to store validation errors
$errmsg_arr = array();
//Validation error flag
$errflag = false;
//Connect to mysql server
$link = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
if(!$link) {
die('Failed to connect to server: ' . mysql_error());
}
//Select database
$db = mysql_select_db(DB_DATABASE);
if(!$db) {
die("Unable to select database");
}
$email = clean($_POST['email']);
$password1 = clean($_POST['password1']);
if(!valid_email_address($email)) {
$errmsg_arr[] = 'Invalid email address';
$errflag = true;
}
if($password1 == '') {
$errmsg_arr[] = 'Password missing';
$errflag = true;
}
//Check for duplicate login ID
if(!$errflag) {
$query = "SELECT * FROM users WHERE email='$email' AND password='$password1'";
//$query = "SELECT * FROM users";
$result = query($query);
if($result) {
if(mysql_num_rows($result) > 0) {
echo "Logged in successfully
";
}
else
{
echo "Username or password incorrect
";
}
@mysql_free_result($result);
}
else {
die("Query failed!");
}
}
else {
$_SESSION['ERRMSG_ARR'] = $errmsg_arr;
session_write_close();
ob_clean();
header("location: index.php?p=login.php");
exit();
}
}
?>
LOGIN