function error :(
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
$listlocation = new auth();
$connection = mysql_connect($dbhost, $dbusername, $dbpass);
$SelectedDB = mysql_select_db($dbname);
$listlocations = mysql_query("SELECT * from locations");
// DELETE location
if ($action=="Delete") {
$delete = $listlocation->delete_location($location);
if ($delete) {
$message = $delete;
$action = "";
}
else {
$location = "";
$shortlocation = "";
$message = "The location has been deleted.";
}
}
$connection = mysql_connect($dbhost, $dbusername, $dbpass);
$SelectedDB = mysql_select_db($dbname);
$listlocations = mysql_query("SELECT * from locations");
// DELETE location
if ($action=="Delete") {
$delete = $listlocation->delete_location($location);
if ($delete) {
$message = $delete;
$action = "";
}
else {
$location = "";
$shortlocation = "";
$message = "The location has been deleted.";
}
}
in auth.php heb ik het volgende staan :
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
2
3
4
5
6
7
8
9
10
11
12
13
14
15
class auth{
// CHANGE THESE VALUES TO REFLECT YOUR SERVER'S SETTINGS
var $HOST = "localhost"; // Change this to the proper DB HOST
var $USERNAME = "****"; // Change this to the proper DB USERNAME
var $PASSWORD = "****"; // Change this to the proper DB USER PASSWORD
var $DBNAME = "****"; // Change this to the proper DB NAME
// DELETE Location
function delete_location($location) {
$qDelete = "DELETE FROM locations WHERE location='$location'";
$result = mysql_query($qDelete);
return mysql_error();
} // End: class auth
// CHANGE THESE VALUES TO REFLECT YOUR SERVER'S SETTINGS
var $HOST = "localhost"; // Change this to the proper DB HOST
var $USERNAME = "****"; // Change this to the proper DB USERNAME
var $PASSWORD = "****"; // Change this to the proper DB USER PASSWORD
var $DBNAME = "****"; // Change this to the proper DB NAME
// DELETE Location
function delete_location($location) {
$qDelete = "DELETE FROM locations WHERE location='$location'";
$result = mysql_query($qDelete);
return mysql_error();
} // End: class auth
als ik nu probeer een entry te deleten krijg ik :
Fatal error: Call to a member function delete_location() on a non-object in locations.php on line 75
Ik mis de sluit accolade voor de "delete_location" method. Raar dat PHP niet zegt dat de "auth" klasse niet wordt afgesloten.
Ik weet dat modify_location en add_location niet compeet zijn, echter aangezien delete de eenvoudigste is probeer ik die eerst werkend te krijgen. Van daaruit krijg ik zelf de 2 andere wel aan het werk.
locations.php
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
<?
include_once ("../auth.php");
include_once ("../authconfig.php");
include_once ("../check.php");
include("style.php");
if ($check['level'] != 1)
{
// Feel free to change the error message below. Just make sure you put a "\" before
// any double quote.
print "<font face=\"Arial, Helvetica, sans-serif\" size=\"5\" color=\"#FF0000\">";
print "<b>Illegal Access</b>";
print "</font><br>";
print "<font face=\"Verdana, Arial, Helvetica, sans-serif\" size=\"2\" color=\"#000000\">";
print "<b>You do not have permission to view this page.</b></font>";
exit; // End program execution. This will disable continuation of processing the rest of the page.
}
$listlocations = new auth();
$connection = mysql_connect($dbhost, $dbusername, $dbpass);
$SelectedDB = mysql_select_db($dbname);
$listlocations = mysql_query("SELECT * from locations");
?>
<?
// Check if we have instantiated $action and $act variable
// If yes, get the value from previous posting
// If not, set values to null or ""
if (isset($_POST['action']))
{
$action = $_POST['action'];
$act = "";
$location = $_POST['location'];
$shortlocation = $_POST['shortlocation'];
}
elseif (isset($_GET['act']))
{
$act = $_GET['act'];
$action = "";
}
else
{
$action = "";
$act = "";
$location = "";
$shortlocation = "";
}
$message = "";
// ADD Location
if ($action == "Add") {
$situation = $user->add_location($location, $shotlocation);
if ($situation == "blank location name") {
$message = "Location field cannot be blank.";
$action = "";
}
elseif ($situation == "location exists") {
$message = "Location already exists in the database. Please enter a new one.";
$action = "";
}
elseif ($situation == 1) {
$message = "New location added successfully.";
}
else {
$message = "";
}
}
// DELETE location
if ($action=="Delete") {
$delete = $listlocations->delete_location($location);
if ($delete) {
$message = $delete;
$action = "";
}
else {
$location = "";
$shortlocation = "";
$message = "The location has been deleted.";
}
}
// MODIFY Location
if ($action == "Modify") {
$update = $user->modify_location($location, $shortlocation);
if ($update==1) {
$message = "Location detail updated successfully.";
}
elseif ($update == "Shortlocation field cannot be blank.") {
$message = $update;
$action = "";
}
else {
$message = "";
}
}
// EDIT TEAM (accessed from clicking on username links)
if ($act == "Edit") {
$location = $_GET['location'];
$shortlocation = $_GET['shortlocation'];
$message = "Modify location details.";
}
// CLEAR FIELDS
if ($action == "Add New") {
$location = "";
$shortlocation = "";
$message = "New location detail entry.";
}
?>
<html>
<head>
<title>Taxi 285 group administration</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<DIV class="fontblue12" align="center">Taxi 285 Locations Administration </DIV>
<?php include("head.php"); ?>
<div align="center">
<table width="75%" cellspacing="0" cellpadding="0" >
<tr>
<td width="16%" class="fontblack12" align="center"><a href="../members/bylevel.php">Reservations</a></td>
<td width="16%" class="fontblack12" align="center"><a href="authgroup.php">Groups</a></td>
<td width="16%" class="fontblack12" align="center"><a href="authuser.php">Users</a></td>
<td width="16%" class="fontblack12" align="center"><a href="locations.php">Locations</a></td>
<td width="16%" class="fontblack12" align="center"><a href="<? echo $logout; ?>">Logout</a></td>
</tr>
</table>
</div>
<?php include("foot.php"); ?>
<?php include("headmed.php"); ?>
<table>
<tr>
<td class="fontblue11">Message:</td>
<td width="500"><div class="fontred11">
<?
if ($message) {
print $message;
}
else {
print "<BR> ";
}
?></div>
</td>
</tr>
</table>
<?php include("foot.php"); ?>
<?php include("headmed.php"); ?>
<table>
<tr valign="top">
<td width="50%" align="left">
<table>
<tr valign="top">
<td colspan="3">
<div class="fontblue12" align="center">LOCATION LIST</div><hr>
</td>
</tr>
<tr><td><table class="style13"><tr>
<td align="left" class="style13" width="170" >Location Name
</td>
<td align="left" class="style13" width="90" >Short
</td>
</tr>
<?
// Fetch rows from AuthUser table and display ALL users
$qQuery = "SELECT * FROM locations ORDER BY locationid";
// OLD CODE - DO NOT REMOVE
// $result = mysql_db_query($dbname, $qQuery);
// REVISED CODE
$result = mysql_query($qQuery);
$row = mysql_fetch_array($result);
while ($row) {
print "<tr>";
print " <td align=\"left\" class=\"style14\">";
print " <a href=\"locations.php?act=Edit&location=".$row["location"]."&shortlocation=".$row["shortlocation"]."\">";
print $row["location"];
print " </a>";
print " </td>";
print " <td align=\"left\" class=\"style14\">";
print $row["shortlocation"];
print " </td>";
print "</tr>";
$row = mysql_fetch_array($result);
}
?>
</tr></td></table>
</table>
</td>
<td width="11" height="100%" rowspan="4" align="center" valign="middle" background="images/center_line.gif"><img src="images/center_line.gif" width="11" height="11">
</td>
<td align="right"><div align="center">
<table width="300"><form name="addlocation" method="Post" action="locations.php">
<tr>
<td colspan="2">
<div align="center" class="fontblue12">LOCATION DETAILS</div><hr>
</td>
</tr>
<tr valign="middle">
<td align="left" class="fontblack12">Location</td>
<td align="left" class="fontblack12">
<?
print "<input type=\"text\" name=\"location\" size=\"30\" maxlength=\"30\" value=\"$location\">";
?>
</td>
</tr>
<tr valign="middle">
<td align="left" class="fontblack12">Short</td>
<td align="left" class="fontblack12">
<?
print "<input type=\"text\" name=\"shortlocation\" size=\"20\" maxlength=\"20\" value=\"$shortlocation\">";
?>
</td>
</tr>
<tr valign="middle">
<td colspan="2"><hr>
<div align="center" class="fontblack11">
<?
if (($action=="Add") || ($action == "Modify") || ($act=="Edit")) {
print "<input type=\"submit\" name=\"action\" value=\"Add New\"> ";
print "<input type=\"submit\" name=\"action\" value=\"Modify\"> ";
print "<input type=\"submit\" name=\"action\" value=\"Delete\"> ";
}
else {
print "<input type=\"submit\" name=\"action\" value=\"Add\"> ";
}
?>
<input type="reset" name="Reset" value="Clear">
</div>
</td>
</tr></form>
</table>
</div>
</td></tr></table>
<?php include("foot.php"); ?>
include_once ("../auth.php");
include_once ("../authconfig.php");
include_once ("../check.php");
include("style.php");
if ($check['level'] != 1)
{
// Feel free to change the error message below. Just make sure you put a "\" before
// any double quote.
print "<font face=\"Arial, Helvetica, sans-serif\" size=\"5\" color=\"#FF0000\">";
print "<b>Illegal Access</b>";
print "</font><br>";
print "<font face=\"Verdana, Arial, Helvetica, sans-serif\" size=\"2\" color=\"#000000\">";
print "<b>You do not have permission to view this page.</b></font>";
exit; // End program execution. This will disable continuation of processing the rest of the page.
}
$listlocations = new auth();
$connection = mysql_connect($dbhost, $dbusername, $dbpass);
$SelectedDB = mysql_select_db($dbname);
$listlocations = mysql_query("SELECT * from locations");
?>
<?
// Check if we have instantiated $action and $act variable
// If yes, get the value from previous posting
// If not, set values to null or ""
if (isset($_POST['action']))
{
$action = $_POST['action'];
$act = "";
$location = $_POST['location'];
$shortlocation = $_POST['shortlocation'];
}
elseif (isset($_GET['act']))
{
$act = $_GET['act'];
$action = "";
}
else
{
$action = "";
$act = "";
$location = "";
$shortlocation = "";
}
$message = "";
// ADD Location
if ($action == "Add") {
$situation = $user->add_location($location, $shotlocation);
if ($situation == "blank location name") {
$message = "Location field cannot be blank.";
$action = "";
}
elseif ($situation == "location exists") {
$message = "Location already exists in the database. Please enter a new one.";
$action = "";
}
elseif ($situation == 1) {
$message = "New location added successfully.";
}
else {
$message = "";
}
}
// DELETE location
if ($action=="Delete") {
$delete = $listlocations->delete_location($location);
if ($delete) {
$message = $delete;
$action = "";
}
else {
$location = "";
$shortlocation = "";
$message = "The location has been deleted.";
}
}
// MODIFY Location
if ($action == "Modify") {
$update = $user->modify_location($location, $shortlocation);
if ($update==1) {
$message = "Location detail updated successfully.";
}
elseif ($update == "Shortlocation field cannot be blank.") {
$message = $update;
$action = "";
}
else {
$message = "";
}
}
// EDIT TEAM (accessed from clicking on username links)
if ($act == "Edit") {
$location = $_GET['location'];
$shortlocation = $_GET['shortlocation'];
$message = "Modify location details.";
}
// CLEAR FIELDS
if ($action == "Add New") {
$location = "";
$shortlocation = "";
$message = "New location detail entry.";
}
?>
<html>
<head>
<title>Taxi 285 group administration</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<DIV class="fontblue12" align="center">Taxi 285 Locations Administration </DIV>
<?php include("head.php"); ?>
<div align="center">
<table width="75%" cellspacing="0" cellpadding="0" >
<tr>
<td width="16%" class="fontblack12" align="center"><a href="../members/bylevel.php">Reservations</a></td>
<td width="16%" class="fontblack12" align="center"><a href="authgroup.php">Groups</a></td>
<td width="16%" class="fontblack12" align="center"><a href="authuser.php">Users</a></td>
<td width="16%" class="fontblack12" align="center"><a href="locations.php">Locations</a></td>
<td width="16%" class="fontblack12" align="center"><a href="<? echo $logout; ?>">Logout</a></td>
</tr>
</table>
</div>
<?php include("foot.php"); ?>
<?php include("headmed.php"); ?>
<table>
<tr>
<td class="fontblue11">Message:</td>
<td width="500"><div class="fontred11">
<?
if ($message) {
print $message;
}
else {
print "<BR> ";
}
?></div>
</td>
</tr>
</table>
<?php include("foot.php"); ?>
<?php include("headmed.php"); ?>
<table>
<tr valign="top">
<td width="50%" align="left">
<table>
<tr valign="top">
<td colspan="3">
<div class="fontblue12" align="center">LOCATION LIST</div><hr>
</td>
</tr>
<tr><td><table class="style13"><tr>
<td align="left" class="style13" width="170" >Location Name
</td>
<td align="left" class="style13" width="90" >Short
</td>
</tr>
<?
// Fetch rows from AuthUser table and display ALL users
$qQuery = "SELECT * FROM locations ORDER BY locationid";
// OLD CODE - DO NOT REMOVE
// $result = mysql_db_query($dbname, $qQuery);
// REVISED CODE
$result = mysql_query($qQuery);
$row = mysql_fetch_array($result);
while ($row) {
print "<tr>";
print " <td align=\"left\" class=\"style14\">";
print " <a href=\"locations.php?act=Edit&location=".$row["location"]."&shortlocation=".$row["shortlocation"]."\">";
print $row["location"];
print " </a>";
print " </td>";
print " <td align=\"left\" class=\"style14\">";
print $row["shortlocation"];
print " </td>";
print "</tr>";
$row = mysql_fetch_array($result);
}
?>
</tr></td></table>
</table>
</td>
<td width="11" height="100%" rowspan="4" align="center" valign="middle" background="images/center_line.gif"><img src="images/center_line.gif" width="11" height="11">
</td>
<td align="right"><div align="center">
<table width="300"><form name="addlocation" method="Post" action="locations.php">
<tr>
<td colspan="2">
<div align="center" class="fontblue12">LOCATION DETAILS</div><hr>
</td>
</tr>
<tr valign="middle">
<td align="left" class="fontblack12">Location</td>
<td align="left" class="fontblack12">
<?
print "<input type=\"text\" name=\"location\" size=\"30\" maxlength=\"30\" value=\"$location\">";
?>
</td>
</tr>
<tr valign="middle">
<td align="left" class="fontblack12">Short</td>
<td align="left" class="fontblack12">
<?
print "<input type=\"text\" name=\"shortlocation\" size=\"20\" maxlength=\"20\" value=\"$shortlocation\">";
?>
</td>
</tr>
<tr valign="middle">
<td colspan="2"><hr>
<div align="center" class="fontblack11">
<?
if (($action=="Add") || ($action == "Modify") || ($act=="Edit")) {
print "<input type=\"submit\" name=\"action\" value=\"Add New\"> ";
print "<input type=\"submit\" name=\"action\" value=\"Modify\"> ";
print "<input type=\"submit\" name=\"action\" value=\"Delete\"> ";
}
else {
print "<input type=\"submit\" name=\"action\" value=\"Add\"> ";
}
?>
<input type="reset" name="Reset" value="Clear">
</div>
</td>
</tr></form>
</table>
</div>
</td></tr></table>
<?php include("foot.php"); ?>
auth.php
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
<?php
class auth{
// CHANGE THESE VALUES TO REFLECT YOUR SERVER'S SETTINGS
var $HOST = "localhost"; // Change this to the proper DB HOST
var $USERNAME = "****"; // Change this to the proper DB USERNAME
var $PASSWORD = "****"; // Change this to the proper DB USER PASSWORD
var $DBNAME = "*****"; // Change this to the proper DB NAME
// AUTHENTICATE
function authenticate($username, $password) {
$query = "SELECT * FROM authuser WHERE uname='$username' AND passwd=MD5('$password') AND status <> 'inactive'";
$UpdateRecords = "UPDATE authuser SET lastlogin = NOW(), logincount = logincount + 1 WHERE uname='$username'";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($query);
$numrows = mysql_num_rows($result);
$row = mysql_fetch_array($result);
// CHECK IF THERE ARE RESULTS
// Logic: If the number of rows of the resulting recordset is 0, that means that no
// match was found. Meaning, wrong username-password combination.
if ($numrows == 0) {
return 0;
}
/*
elseif ($row["level"]==1) { // ADMIN LOGIN
$Update = mysql_query($UpdateRecords);
return 1;
}
*/
else {
$Update = mysql_query($UpdateRecords);
return $row;
}
} // End: function authenticate
// PAGE CHECK
// This function is the one used for every page that is to be secured. This is not the same one
// used in the initial login screen
function page_check($username, $password) {
$query = "SELECT * FROM authuser WHERE uname='$username' AND passwd=MD5('$password') AND status <> 'inactive'";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($query);
$numrows = mysql_num_rows($result);
$row = mysql_fetch_array($result);
// CHECK IF THERE ARE RESULTS
// Logic: If the number of rows of the resulting recordset is 0, that means that no
// match was found. Meaning, wrong username-password combination.
if ($numrows == 0) {
return false;
}
else {
return $row;
}
} // End: function page_check
// MODIFY USERS
function modify_user($username, $password, $email, $team, $level, $status, $realname) {
// If $password is blank, make no changes to the current password
if (trim($password == ''))
{
$qUpdate = "UPDATE authuser SET team='$team', level='$level', email='$email', status='$status', realname='$realname' WHERE uname='$username'";
}
else
{
$qUpdate = "UPDATE authuser SET passwd=MD5('$password'), team='$team', level='$level', status='$status', realname='realname'
WHERE uname='$username'";
}
if (trim($level)=="") {
return "blank level";
}
else {
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qUpdate);
return 1;
}
} // End: function modify_user
// DELETE USERS
function delete_user($username) {
$qDelete = "DELETE FROM authuser WHERE uname='$username'";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qDelete);
return mysql_error();
} // End: function delete_user
// ADD USERS
function add_user($username, $password, $email, $team, $level, $status, $realname) {
$qUserExists = "SELECT * FROM authuser WHERE uname='$username'";
$qInsertUser = "INSERT INTO authuser(uname, passwd, email, team, level, status, realname, lastlogin, logincount)
VALUES ('$username', MD5('$password'), '$email', '$team', '$level', '$status', 'realname', '', 0)";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
// Check if all fields are filled up
if (trim($username) == "") {
return "blank username";
}
// password check added 09-19-2003
elseif (trim($password) == "") {
return "blank password";
}
elseif (trim($level) == "") {
return "blank level";
}
// Check if user exists
$SelectedDB = mysql_select_db($this->DBNAME);
$user_exists = mysql_query($qUserExists);
if (mysql_num_rows($user_exists) > 0) {
return "username exists";
}
else {
// Add user to DB
// OLD CODE - DO NOT REMOVE
// $result = mysql_db_query($this->DBNAME, $qInsertUser);
// REVISED CODE
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qInsertUser);
return mysql_affected_rows();
}
} // End: function add_user
// *****************************************************************************************
// ************************************** G R O U P S **************************************
// *****************************************************************************************
// ADD TEAM
function add_team($teamname, $teamlead, $status="active") {
$qGroupExists = "SELECT * FROM authteam WHERE teamname='$teamname'";
$qInsertGroup = "INSERT INTO authteam(teamname, teamlead, status)
VALUES ('$teamname', '$teamlead', '$status')";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
// Check if all fields are filled up
if (trim($teamname) == "") {
return "blank team name";
}
// Check if group exists
// OLD CODE - DO NOT REMOVE
// $group_exists = mysql_db_query($this->DBNAME, $qGroupExists);
// REVISED CODE
$SelectedDB = mysql_select_db($this->DBNAME);
$group_exists = mysql_query($qGroupExists);
if (mysql_num_rows($group_exists) > 0) {
return "group exists";
}
else {
// Add user to DB
// OLD CODE - DO NOT REMOVE
// $result = mysql_db_query($this->DBNAME, $qInsertGroup);
// REVISED CODE
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qInsertGroup);
return mysql_affected_rows();
}
} // End: function add_group
// MODIFY TEAM
function modify_team($teamname, $teamlead, $status) {
$qUpdate = "UPDATE authteam SET teamlead='$teamlead', status='$status'
WHERE teamname='$teamname'";
$qUserStatus = "UPDATE authuser SET status='$status' WHERE team='$teamname'";
if ($teamname == "Admin" AND $status=="inactive") {
return "Admin team cannot be inactivated.";
}
elseif ($teamname == "Ungrouped" AND $status=="inactive") {
return "Ungrouped team cannot be inactivated.";
}
else {
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
// UPDATE STATUS IF STATUS OF TEAM IS INACTIVATED
// OLD CODE - DO NOT REMOVE
//$userresult = mysql_db_query($this->DBNAME, $qUserStatus);
// REVISED CODE
$SelectedDB = mysql_select_db($this->DBNAME);
$userresult = mysql_query($qUserStatus);
// OLD CODE - DO NOT REMOVE
// $result = mysql_db_query($this->DBNAME, $qUpdate);
// REVISED CODE
$result = mysql_query($qUpdate);
return 1;
}
} // End: function modify_team
// DELETE TEAM
function delete_team($teamname) {
$qDelete = "DELETE FROM authteam WHERE teamname='$teamname'";
$qUpdateUser = "UPDATE authuser SET team='Ungrouped' WHERE team='$teamname'";
if ($teamname == "Admin") {
return "Admin team cannot be deleted.";
}
elseif ($teamname == "Ungrouped") {
return "Ungrouped team cannot be deleted.";
}
elseif ($teamname == "Temporary") {
return "Temporary team cannot be deleted.";
}
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
// OLD CODE - DO NOTE REMOVE
// $result = mysql_db_query($this->DBNAME, $qUpdateUser);
// REVISED CODE
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qUpdateUser);
// OLD CODE - DO NOT REMOVE
// $result = mysql_db_query($this->DBNAME, $qDelete);
// REVISED CODE
$result = mysql_query($qDelete);
return mysql_error();
} // End: function delete_team
// *****************************************************************************************
// **************************** L O C A T I O N S **************************************
// *************************************************************************************
// ADD location
function add_location($location, $shortlocation) {
$locationExists = "SELECT * FROM locations WHERE location='$location'";
$qInsertlocation = "INSERT INTO locations(location, shortlocation)
VALUES ('$location', '$shortlocation')";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
// Check if all fields are filled up
if (trim($location) == "") {
return "blank location name";
}
$SelectedDB = mysql_select_db($this->DBNAME);
$location_exists = mysql_query($locationExists);
if (mysql_num_rows($location_exists) > 0) {
return "location exists";
}
else {
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qInsertlocation);
return mysql_affected_rows();
}
} // End: function add_location
// MODIFY LOCATION
function modify_location($location, $shortlocation) {
$qUpdate = "UPDATE locations SET location='$location', shortlocation='shortlocation'
WHERE location='$location'";
$result = mysql_query($qUpdate);
return 1;
}
// End: function modify_location
// DELETE Location
function delete_location($location) {
$qDelete = "DELETE FROM locations WHERE location='$location'";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qDelete);
return mysql_error();
} // End DELETE location
} // End: class auth
?>
class auth{
// CHANGE THESE VALUES TO REFLECT YOUR SERVER'S SETTINGS
var $HOST = "localhost"; // Change this to the proper DB HOST
var $USERNAME = "****"; // Change this to the proper DB USERNAME
var $PASSWORD = "****"; // Change this to the proper DB USER PASSWORD
var $DBNAME = "*****"; // Change this to the proper DB NAME
// AUTHENTICATE
function authenticate($username, $password) {
$query = "SELECT * FROM authuser WHERE uname='$username' AND passwd=MD5('$password') AND status <> 'inactive'";
$UpdateRecords = "UPDATE authuser SET lastlogin = NOW(), logincount = logincount + 1 WHERE uname='$username'";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($query);
$numrows = mysql_num_rows($result);
$row = mysql_fetch_array($result);
// CHECK IF THERE ARE RESULTS
// Logic: If the number of rows of the resulting recordset is 0, that means that no
// match was found. Meaning, wrong username-password combination.
if ($numrows == 0) {
return 0;
}
/*
elseif ($row["level"]==1) { // ADMIN LOGIN
$Update = mysql_query($UpdateRecords);
return 1;
}
*/
else {
$Update = mysql_query($UpdateRecords);
return $row;
}
} // End: function authenticate
// PAGE CHECK
// This function is the one used for every page that is to be secured. This is not the same one
// used in the initial login screen
function page_check($username, $password) {
$query = "SELECT * FROM authuser WHERE uname='$username' AND passwd=MD5('$password') AND status <> 'inactive'";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($query);
$numrows = mysql_num_rows($result);
$row = mysql_fetch_array($result);
// CHECK IF THERE ARE RESULTS
// Logic: If the number of rows of the resulting recordset is 0, that means that no
// match was found. Meaning, wrong username-password combination.
if ($numrows == 0) {
return false;
}
else {
return $row;
}
} // End: function page_check
// MODIFY USERS
function modify_user($username, $password, $email, $team, $level, $status, $realname) {
// If $password is blank, make no changes to the current password
if (trim($password == ''))
{
$qUpdate = "UPDATE authuser SET team='$team', level='$level', email='$email', status='$status', realname='$realname' WHERE uname='$username'";
}
else
{
$qUpdate = "UPDATE authuser SET passwd=MD5('$password'), team='$team', level='$level', status='$status', realname='realname'
WHERE uname='$username'";
}
if (trim($level)=="") {
return "blank level";
}
else {
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qUpdate);
return 1;
}
} // End: function modify_user
// DELETE USERS
function delete_user($username) {
$qDelete = "DELETE FROM authuser WHERE uname='$username'";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qDelete);
return mysql_error();
} // End: function delete_user
// ADD USERS
function add_user($username, $password, $email, $team, $level, $status, $realname) {
$qUserExists = "SELECT * FROM authuser WHERE uname='$username'";
$qInsertUser = "INSERT INTO authuser(uname, passwd, email, team, level, status, realname, lastlogin, logincount)
VALUES ('$username', MD5('$password'), '$email', '$team', '$level', '$status', 'realname', '', 0)";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
// Check if all fields are filled up
if (trim($username) == "") {
return "blank username";
}
// password check added 09-19-2003
elseif (trim($password) == "") {
return "blank password";
}
elseif (trim($level) == "") {
return "blank level";
}
// Check if user exists
$SelectedDB = mysql_select_db($this->DBNAME);
$user_exists = mysql_query($qUserExists);
if (mysql_num_rows($user_exists) > 0) {
return "username exists";
}
else {
// Add user to DB
// OLD CODE - DO NOT REMOVE
// $result = mysql_db_query($this->DBNAME, $qInsertUser);
// REVISED CODE
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qInsertUser);
return mysql_affected_rows();
}
} // End: function add_user
// *****************************************************************************************
// ************************************** G R O U P S **************************************
// *****************************************************************************************
// ADD TEAM
function add_team($teamname, $teamlead, $status="active") {
$qGroupExists = "SELECT * FROM authteam WHERE teamname='$teamname'";
$qInsertGroup = "INSERT INTO authteam(teamname, teamlead, status)
VALUES ('$teamname', '$teamlead', '$status')";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
// Check if all fields are filled up
if (trim($teamname) == "") {
return "blank team name";
}
// Check if group exists
// OLD CODE - DO NOT REMOVE
// $group_exists = mysql_db_query($this->DBNAME, $qGroupExists);
// REVISED CODE
$SelectedDB = mysql_select_db($this->DBNAME);
$group_exists = mysql_query($qGroupExists);
if (mysql_num_rows($group_exists) > 0) {
return "group exists";
}
else {
// Add user to DB
// OLD CODE - DO NOT REMOVE
// $result = mysql_db_query($this->DBNAME, $qInsertGroup);
// REVISED CODE
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qInsertGroup);
return mysql_affected_rows();
}
} // End: function add_group
// MODIFY TEAM
function modify_team($teamname, $teamlead, $status) {
$qUpdate = "UPDATE authteam SET teamlead='$teamlead', status='$status'
WHERE teamname='$teamname'";
$qUserStatus = "UPDATE authuser SET status='$status' WHERE team='$teamname'";
if ($teamname == "Admin" AND $status=="inactive") {
return "Admin team cannot be inactivated.";
}
elseif ($teamname == "Ungrouped" AND $status=="inactive") {
return "Ungrouped team cannot be inactivated.";
}
else {
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
// UPDATE STATUS IF STATUS OF TEAM IS INACTIVATED
// OLD CODE - DO NOT REMOVE
//$userresult = mysql_db_query($this->DBNAME, $qUserStatus);
// REVISED CODE
$SelectedDB = mysql_select_db($this->DBNAME);
$userresult = mysql_query($qUserStatus);
// OLD CODE - DO NOT REMOVE
// $result = mysql_db_query($this->DBNAME, $qUpdate);
// REVISED CODE
$result = mysql_query($qUpdate);
return 1;
}
} // End: function modify_team
// DELETE TEAM
function delete_team($teamname) {
$qDelete = "DELETE FROM authteam WHERE teamname='$teamname'";
$qUpdateUser = "UPDATE authuser SET team='Ungrouped' WHERE team='$teamname'";
if ($teamname == "Admin") {
return "Admin team cannot be deleted.";
}
elseif ($teamname == "Ungrouped") {
return "Ungrouped team cannot be deleted.";
}
elseif ($teamname == "Temporary") {
return "Temporary team cannot be deleted.";
}
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
// OLD CODE - DO NOTE REMOVE
// $result = mysql_db_query($this->DBNAME, $qUpdateUser);
// REVISED CODE
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qUpdateUser);
// OLD CODE - DO NOT REMOVE
// $result = mysql_db_query($this->DBNAME, $qDelete);
// REVISED CODE
$result = mysql_query($qDelete);
return mysql_error();
} // End: function delete_team
// *****************************************************************************************
// **************************** L O C A T I O N S **************************************
// *************************************************************************************
// ADD location
function add_location($location, $shortlocation) {
$locationExists = "SELECT * FROM locations WHERE location='$location'";
$qInsertlocation = "INSERT INTO locations(location, shortlocation)
VALUES ('$location', '$shortlocation')";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
// Check if all fields are filled up
if (trim($location) == "") {
return "blank location name";
}
$SelectedDB = mysql_select_db($this->DBNAME);
$location_exists = mysql_query($locationExists);
if (mysql_num_rows($location_exists) > 0) {
return "location exists";
}
else {
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qInsertlocation);
return mysql_affected_rows();
}
} // End: function add_location
// MODIFY LOCATION
function modify_location($location, $shortlocation) {
$qUpdate = "UPDATE locations SET location='$location', shortlocation='shortlocation'
WHERE location='$location'";
$result = mysql_query($qUpdate);
return 1;
}
// End: function modify_location
// DELETE Location
function delete_location($location) {
$qDelete = "DELETE FROM locations WHERE location='$location'";
$connection = mysql_connect($this->HOST, $this->USERNAME, $this->PASSWORD);
$SelectedDB = mysql_select_db($this->DBNAME);
$result = mysql_query($qDelete);
return mysql_error();
} // End DELETE location
} // End: class auth
?>
Gewijzigd op 01/01/1970 01:00:00 door Ton
Je kunt het beste even dit bovenin je script zetten:
Gewijzigd op 01/01/1970 01:00:00 door Martijn B
Gewijzigd op 01/01/1970 01:00:00 door Martijn B
Werkt die error reporting altijd als ik een niew script schrijf ?