document.write('');
document.write('
// First we connect to the database');
document.write('db::
connect(\'localhost\',
\'root\',
\'\',
\'testDatabase\');
');
document.write('
');
document.write('
// Input is the following:');
document.write('
// $_POST[\'username\'] containing the specified username.');
document.write('
// $_POST[\'password\'] cointainging the specified password.');
document.write('
');
document.write('
// The first thing you always do with data which comes from the use');
document.write('
// is to sanitize it (never trust the user).');
document.write('
// The function db::escape() is a pseudo function for functions such as');
document.write('
// mysql_real_escape_string() and other like it or in worst case just for');
document.write('
// addslashes()');
document.write('
$_POST[\'username\'] = db::
escape($_POST[\'username\']);
');
document.write('
// Never store passwords unless you have encrypted them first!');
document.write('
// Think about this situation, your database gets hacked and the hackers');
document.write('
// manages to retrieve your whole user table. What do you think they');
document.write('
// might do then? Login as a user (possible with the highest rank, admin)');
document.write('
// and play around. But if you store the password in an encrypted form,');
document.write('
// they have no chanse to do this.');
document.write('
$_POST[\'password\'] =
sha1($_POST[\'password\']);
');
document.write('
');
document.write('
// Now let\'s execute a query to se if we have a match');
document.write('
$result = db::
query("SELECT `userID` FROM `users` WHERE `username` = \'".
$_POST[\'username\'].
"\' AND `password` = \'".
$_POST[\'password\'].
"\'");
');
document.write('
');
document.write('
// Did any rows match?');
document.write('
if (db::
numRows($result) ==
0)');
document.write('
// No rows matched, send the user a error message');
document.write('
echo \'The username you enetered doesn\\'t exists or the password supplied with the username is incorrect, please try again.\';
');
document.write('
else');
document.write('
// The query matched a username with the specified password =D');
document.write('
echo \'Woho, you are one of us! Here are the top secret documents..\';
');
document.write('
');