Didnt see that error, but nope, its still not fixed
Index.php:
http://pastebin.com/vZuBX9wd[syntax=php]<?php
include('core/init.inc.php');
?>
<html>
<head>
<link rel="stylesheet" type="text/css" href="ext/main.css">
</head>
<body>
<div id="wrap">
<?php
include($include_file);
?>
</div>
</body>
</html>[/syntax]
user.inc.php:
http://pastebin.com/F7NsQupL[syntax=php]<?php
//Checks a given Username & Password combo.
function validate_credentials($user_name, $user_password){
$user_name = mysql_real_escape_string($user_name);
$user_password sha1($user_password);
$result = mysql_query("SELECT 'user_id' FROM 'users' WHERE 'user_name' = '{$user_name}' AND 'user_password' = '{$user_password}'");
if (mysql_num_rows($result) != 1){
return false;
}
return mysql_result($result, 0); //return ID.
}
?>[/syntax]
login.page.inc.php:
http://pastebin.com/N8K9gfG9[syntax=php]<h1>Login</h1>
<?php
if (isset($_POST['user_name'], $_POST['user_password'])){
echo '<div class="msg error">Login Failed.</div>';
}
?>
<form action="index.php?page=login" method="post">
<div>
<label for="user_name">Username:</label>
<input type="text" name="user_name" id="user_name">
</div>
<div>
<label for="user_password">Password:</label>
<input type="password" name="user_password" id="user_password">
</div>
<div>
<input type="submit" value="Login" />
</div>
</form>[/syntax]
and init.inc.php (already sent)
[syntax=php] <?php
$core_path = dirname(__FILE__);
if (empty($_GET['page']) || in_array("{$_GET['page']}.page.inc.php", scandir("{$core_path}/pages")) == false){
header('HTTP/1.1 404 Not Found');
header('Location: index.php?page=inbox');
die();
}
session_start();
mysql_connect('localhost', 'user', 'pass');
mysql_select_db('db_name');
include("{$core_path}/inc/user.inc.php");
if (isset($_POST['user_name'], $_POST['user_password'])){
if (($user_id = validate_crendenials($_POST['user_name'], $_POST['user_password'])) !== false){
$SESSION['user_id'] = $user_id;
header('Location: index.php?page=inbox');
die();
}
}
if (empty($_SESSION['user_id']) && $_GET['page'] !== 'login'){
header('HTTP/1.1 403 Forbidden');
header('Location: index.php?page=login');
die();
}
$include_file = "{$core_path}/pages/{$_GET['page']}.page.inc.php";
?> [/syntax]
