/home/techb158/immovalet.ca/report/includes
Edit: /home/techb158/immovalet.ca/report/includes/functions.php (17179B)
prepare("SELECT C_ID
FROM Clients
WHERE Username = ? LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
// get variables from result.
$stmt->bind_result($user_id);
$stmt->fetch();
if ($stmt->num_rows == 1) {
$_SESSION['UserDB'] = "Clients";
$_SESSION['UID'] = "C_ID";
return true;
}
}
if ($stmt = $mysqli->prepare("SELECT U_ID
FROM Users
WHERE Username = ? LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
// get variables from result.
$stmt->bind_result($user_id);
$stmt->fetch();
if ($stmt->num_rows == 1) {
$_SESSION['UserDB'] = "User";
$_SESSION['UID'] = "U_ID";
return true;
}
}
if ($stmt = $mysqli->prepare("SELECT Ag_ID
FROM Agent
WHERE Username = ? LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
// get variables from result.
$stmt->bind_result($user_id);
$stmt->fetch();
if ($stmt->num_rows == 1) {
$_SESSION['UserDB'] = "Agent";
$_SESSION['UID'] = "Ag_ID";
return true;
}
}
if ($stmt = $mysqli->prepare("SELECT M_ID
FROM Master
WHERE Username = ? LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
// get variables from result.
$stmt->bind_result($user_id);
$stmt->fetch();
if ($stmt->num_rows == 1) {
$_SESSION['UserDB'] = "Master";
$_SESSION['UID'] = "M_ID";
return true;
}
}
if ($stmt = $mysqli->prepare("SELECT ID
FROM Admin
WHERE Username = ? LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
// get variables from result.
$stmt->bind_result($user_id);
$stmt->fetch();
if ($stmt->num_rows == 1) {
$_SESSION['UserDB'] = "Admin";
$_SESSION['UID'] = "ID";
return true;
}
}
else{
return false;
}
}
function login($email, $password, $mysqli) {
$ip= $_SERVER["REMOTE_ADDR"];
$agent =$_SERVER["HTTP_USER_AGENT"];
$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
if (checkuser($email, $mysqli)) {
$UserDB = $_SESSION['UserDB'];
$UID = $_SESSION['UID'];
$UA = 1;
// Using prepared statements means that SQL injection is not possible.
$query = "SELECT * FROM $UserDB Where Username = '".$email."' AND User_Access = '".$UA."'";
$result = $mysqli->query($query);
$Managers = $result->fetch_assoc();
$UserAccess = $Managers['User_Access'];
if ($UserAccess == 1) {
if ($stmt = $mysqli->prepare("SELECT $UID, Username, Password, salt
FROM $UserDB
WHERE Username = ? LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
// get variables from result.
$stmt->bind_result($user_id, $username, $db_password, $salt);
$stmt->fetch();
// hash the password with the unique salt.
$password = hash('sha512', $password . $salt);
if ($stmt->num_rows == 1) {
// If the user exists we check if the account is locked
// from too many login attempts
if (checkbrute($user_id, $mysqli) == true) {
//// Account is locked
//// Send an email to user saying their account is locked
//$to= $email;
//$subject = "Your account is locked!";
//$url = "https://". $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
//$message = '
//
//
//
Planly: account locked
//
//
//
Dear Customer,
//
Your account is locked!
//
Thank you for choosing Planly.com.
//
Support Team
//
//
//
//
//';
//$headers = "MIME-Version: 1.0" . "\r\n";
//$headers .= "Content-type:text/html;charset=iso-8859-1" . "\r\n";
//$headers .= 'From: support
' . "\r\n";
//$headers .= 'Bcc: support' . "\r\n";
//mail($to,$subject,$message,$headers);
header("Location: ../error.php?err=error: your account is locked");
exit();
//return false;
}else
{
// Check if the password in the database matches
// the password the user submitted.
if ($db_password == $password) {
// Password is correct!
// Get the user-agent string of the user.
$user_browser = $_SERVER['HTTP_USER_AGENT'];
// XSS protection as we might print this value
$user_id = preg_replace("/[^0-9]+/", "", $user_id);
$_SESSION['user_id'] = $user_id;
$_SESSION['myusername'] = $username;
// XSS protection as we might print this value
$username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username);
$_SESSION['username'] = $username;
$_SESSION['User_type'] = $UserDB;
$_SESSION['login_string'] = hash('sha512', $password . $user_browser);
if (!$mysqli->query("UPDATE $UserDB SET Login_Time = '$datetime', User_IP='$ip', User_agent='$agent' WHERE $UID = '$user_id'")) {
}
// Login successful.
return true;
} else {
// Password is not correct
// We record this attempt in the database
$now = time();
if (!$mysqli->query("INSERT INTO Login_log(User_ID, User_Type, Date_Time, User_IP, User_agent, Time)
VALUES ('$user_id', '$UserDB', '$datetime', '$ip', '$agent', '$now')")) {
header("Location: ../error.php?err=Database error: login_attempts");
exit();
}
//if (!$mysqli->query("INSERT INTO Login_log(User_ID, time)
// VALUES ('$user_id', '$now')")) {
// header("Location: ../error.php?err=Database error: login_attempts");
// exit();
//}
return false;
}
}
} else {
// No user exists.
return false;
}
} else {
// Could not create a prepared statement
header("Location: ../error.php?err=Database error: cannot prepare statement X");
exit();
}
}else{
header("Location: ../error.php?err=error: Access denid");
exit();
}
}else{
// Could not create a prepared statement
header("Location: ../index.php?err=error: you are not allow to login");
exit();
}
}
function checkbrute($user_id, $mysqli) {
// Get timestamp of current time
$now = time();
// All login attempts are counted from the past 5 hours.
$valid_attempts = $now - (60 * 60 * 60);
$UserDB = $_SESSION['UserDB'];
if ($stmt = $mysqli->prepare("SELECT time
FROM Login_log
WHERE User_ID = ? AND time > '$valid_attempts' AND User_Type = '$UserDB'")) {
$stmt->bind_param('i', $user_id);
// Execute the prepared query.
$stmt->execute();
$stmt->store_result();
// If there have been more than 5 failed logins
if ($stmt->num_rows > 5) {
return true;
} else {
return false;
}
} else {
// Could not create a prepared statement
header("Location: ../error.php?err=Database error: cannot prepare statement 1");
exit();
}
}
function login_check($mysqli) {
// Check if all session variables are set
if (isset($_SESSION['user_id'], $_SESSION['username'], $_SESSION['login_string'])) {
$user_id = $_SESSION['user_id'];
$login_string = $_SESSION['login_string'];
$username = $_SESSION['username'];
$UserDB = $_SESSION['UserDB'];
$UID = $_SESSION['UID'];
// Get the user-agent string of the user.
$user_browser = $_SERVER['HTTP_USER_AGENT'];
if ($stmt = $mysqli->prepare("SELECT Password
FROM $UserDB
WHERE $UID = ? LIMIT 1")) {
// Bind "$user_id" to parameter.
$stmt->bind_param('i', $user_id);
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
if ($stmt->num_rows == 1) {
// If the user exists get variables from result.
$stmt->bind_result($password);
$stmt->fetch();
$login_check = hash('sha512', $password . $user_browser);
if ($login_check == $login_string) {
// Logged In!!!!
return true;
} else {
// Not logged in
return false;
}
} else {
// Not logged in
return false;
}
} else {
// Could not prepare statement
header("Location: ../error.php?err=Database error: cannot prepare statement 2");
exit();
}
} else {
// Not logged in
return false;
}
}
function esc_url($url) {
if ('' == $url) {
return $url;
}
$url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
$strip = array('%0d', '%0a', '%0D', '%0A');
$url = (string) $url;
$count = 1;
while ($count) {
$url = str_replace($strip, '', $url, $count);
}
$url = str_replace(';//', '://', $url);
$url = htmlentities($url);
$url = str_replace('&', '&', $url);
$url = str_replace("'", ''', $url);
if ($url[0] !== '/') {
// We're only interested in relative links from $_SERVER['PHP_SELF']
return '';
} else {
return $url;
}
}
function addinfo($pages, $mysqli)
{
$page = $pages;
$querys = "SELECT SUM(count) AS totalhits FROM hits WHERE page='".$page."'";
$results = $mysqli->query($querys);
while($row = $results->fetch_assoc())
{
$totalhits = $row['totalhits'];
}
//$query = mysqli_query($mysqli,"SELECT SUM(count) AS totalhits FROM hits WHERE page = '$page'") or die(mysqli_error());
////$result = mysqli_query($mysqli,$query) or die(mysqli_error());
//while($row = mysqli_fetch_array($query))
//{
// $totalhits = $row['totalhits'] ;
//}
// ########################################################
// ######### check if counter exsist and update ###########
// ########################################################
if(mysqli_num_rows(mysqli_query($mysqli,"SELECT page FROM hits WHERE page = '$page'")))
{
$totalhits++;
//A counter for this page already exsists. Now we have to update it.
$updatecounter = mysqli_query($mysqli,"UPDATE hits SET count = '$totalhits' WHERE page = '$page'");
if (!$updatecounter)
{
//die ("Can't update the counter : " . mysqli_error()); // remove ?
}
}
else
{
// This page did not exsist in the counter database. A new counter must be created for this page.
$insert = mysqli_query($mysqli,"INSERT INTO hits (page, count)VALUES ('$page', '1')");
if (!$insert)
{
// die ("Can\'t insert into hits : " . mysqli_error()); // remove ?
}
}
// ####################################################
// ######### add IP and user-agent and time ###########
// ####################################################
// gather user data
$ip= $_SERVER["REMOTE_ADDR"];
$agent =$_SERVER["HTTP_USER_AGENT"];
$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
if(!mysqli_num_rows(mysqli_query($mysqli,"SELECT ip_address FROM info WHERE ip_address = '$ip'"))) // check if the IP is in database
{
// if not , add it.
$adddata = mysqli_query($mysqli,"INSERT INTO info (ip_address, user_agent, datetime) VALUES('$ip' , '$agent','$datetime' ) ") ;
if (!$adddata)
{
// die('Could not add IP : ' . mysqli_error()); // remove ?
}
}
// ***************************************************************
// ** delete the first entry in $dbtableinfo if rows > $maxrows **
// ***************************************************************
}
function clickpost($pages_id,$page_name, $mysqli)
{
$page = $pages_id;
$querys = "SELECT SUM(count) AS totalhits FROM hits_post WHERE page_id='".$page."'";
$results = $mysqli->query($querys);
while($row = $results->fetch_assoc())
{
$totalhits = $row['totalhits'];
}
//$query = mysqli_query($mysqli,"SELECT SUM(count) AS totalhits FROM hits_post WHERE page = '$page'") or die(mysqli_error());
////$result = mysqli_query($mysqli,$query) or die(mysqli_error());
//while($row = mysqli_fetch_array($query))
//{
// $totalhits = $row['totalhits'] ;
//}
// ########################################################
// ######### check if counter exsist and update ###########
// ########################################################
if(mysqli_num_rows(mysqli_query($mysqli,"SELECT page_id FROM hits_post WHERE page_id = '$page'")))
{
$totalhits++;
//A counter for this page already exsists. Now we have to update it.
$updatecounter = mysqli_query($mysqli,"UPDATE hits_post SET count = '$totalhits' WHERE page_id = '$page'");
if (!$updatecounter)
{
//die ("Can't update the counter : " . mysqli_error()); // remove ?
}
}
else
{
// This page did not exsist in the counter database. A new counter must be created for this page.
$insert = mysqli_query($mysqli,"INSERT INTO hits_post (page_id,page_name, count)VALUES ('$page','$page_name', '1')");
if (!$insert)
{
//die ("Can\'t insert into hits_post : " . mysqli_error()); // remove ?
}
}
// ####################################################
// ######### add IP and user-agent and time ###########
// ####################################################
// gather user data
$ip= $_SERVER["REMOTE_ADDR"];
$agent =$_SERVER["HTTP_USER_AGENT"];
$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
if(!mysqli_num_rows(mysqli_query($mysqli,"SELECT ip_address FROM info_post WHERE ip_address = '$ip'"))) // check if the IP is in database
{
// if not , add it.
$adddata = mysqli_query($mysqli,"INSERT INTO info_post (post_id, ip_address, user_agent, datetime) VALUES('$page' ,'$ip' , '$agent','$datetime' ) ") ;
if (!$adddata)
{
// die('Could not add IP : ' . mysqli_error()); // remove ?
}
}
// ***************************************************************
// ** delete the first entry in $dbtableinfo if rows > $maxrows **
// ***************************************************************
}