<?php include("header.php"); ?>

<?php 

// Login Script version 0.0.8
// By Will Kraft

// Get our form data  

// Help from TheJkWhoSaysNi from forums.massassi.net was provided here to help secure the form postdata
$user = trim($_POST['username']);
$pass = trim($_POST['password']);

//hope the security works.....

//Help provided by Emon and Cool Matty from forums.massassi.net on line 17
//$pass = sha1($pass); 


// define our database parameters 

$dbhost = 'localhost';
$dbuser = [censored]
$dbpass = [censored]
 
if ($user && $pass) {

	// make the connection, or die trying 

	$con = mysql_connect($dbhost, $dbuser, $dbpass) or die('Error: Could not connect to database');

	$dbname = 'ocstcnet_main';
	mysql_select_db($dbname);

	//help with line 28 was provided by TheJkWhoSaysNi and Cool Matty
	$row = mysql_fetch_assoc(mysql_query("SELECT * FROM members WHERE username='$user' AND password='$pass'"));  
	
	if (!$row){
		$error2 = "<br>";
	$error2 .= "<h2>Error</h2>";
	$error2 .= "<br>";
	$error2 .= "<div class='php_output'>The username <b><i>". $user . "</i></b> and password <b><i>" . $pass . "</i></b> is not in the database.</div>";
	$error2 .= "<br>";
	
	echo $error2;
		
	}	
	
	else{
     	 
	echo "Username is good; further content can be added";
	
	}
	
}
		
else {
	
	$error1 = "<br>";
	$error1 .= "<h2>Error</h2>";
	$error1 .= "<br>";
	$error1 .= "<div class='php_output'>You must fill in all fields!</div>";

	echo $error1;

	
	}
	
?>

<?php include("footer.php"); ?>

$pass = sha1($pass); 

$row = mysql_fetch_assoc(mysql_query("username="' . mysql_real_escape_string($user) . '" AND password="' . mysql_real_escape_string($pass)"); 

//In this code we demonstrate an ASP.NET login form that is probably 3x superior.

public void btnLogin_Click(EventArgs ev, object sender)
{
	int iRes = -1;
	try
	{
		//I can store the connect string in a multitude of different things. web.config, XML file, hard-coded
		using (SqlConnection cn = new SqlConnection(_sSqlConnectStr))
		using (SqlCommand cmd = new SqlCommand())
		{
			cmd.Connection = cn;
			cmd.CommandText = "select count(user) from tblUsers with(nolock) where user=@user and pass=@pass";
			cmd.Parameters["@user"] = txtUsername.Text;
			cmd.Parameters["@pass"] = MakeSHA1(txtPassword.Text)
			iRes = (int)cmd.ExecuteScalar();

			//Basically we should get a count > 0 if we our select matches (ie a valid user)
			if (iRes != 0)
				FormsAuthentication.RedirectFromLoginPage(txtUsername.Text,chkSaveState.Checked);
			else
				DoBadUser();
			
		}
	}
	catch (SQLException sex) //Huhuhuhuh
	{
		DoErrorHandling();
	}
}

//The only thing where I might say that PHP has a one up on me, I had to do
//stupid string -> byte[] -> string conversions.
public string MakeSHA1(string sToHash)
{
	if (sToHash == string.Empty)
		return string.Empty;

	byte[] baHashed = new byte[64]; //Is it that big?
	byte[] baStrData = new byte[sToHash.Length];

	baStrData = Encoding.ASCIIEncoding.GetBytes(sToHash);
	
	//This is laziness.
	return (Encoding.ASCIIEncoding.GetString(MakeSHA1(baStrData)));
}

public byte[] MakeSHA1(byte[] baToHash)
{
	SHA1 hash = new SHA1CryptoServiceProvider();
	return hash.ComputeHash(baToHash);
}