init.inc.php
<?php
$core_path = dirname(__FILE__);
if (empty($_GET['page']) || in_array("{$_GET['page']}.page.inc.php", scandir("{$core_path}/pages")) == false){
header('HTTP/1.1 404 Not Found');
header('Location: index.php?page=inbox');
die();
}
session_start();
mysql_connect('mysql12.000webhost.com', '*Hidden*', '*Hidden*');
mysql_select_db('a2954500_users');
if (isset($_POST['user_name'], $_POST['user_password'])){
if (($user_id = validate_credentials($_POST['user_name'], $_POST['user_password'])) !== false){
$_SESSION['user_id'] = $user_id;
header('Location: index.php?page=inbox');
die();
}
}
if (empty($_SESSION['user_id']) && $_GET['page'] !== 'login'){
header('HTTP/1.1 403 Forbidden');
header('location: index.php?page=login');
die();
}
$include_file = "{$core_path}/pages/{$_GET['page']}.page.inc.php";
?>
user.inc.php
<?php
// checks a given username and password combination, returning the user's ID.
function validate_credentials($user_name, $user_password){
$user_name = mysql_real_escape_string($user_name);
$user_password = sha1($user_password);
$result = mysql_query("SELECT `user_id` FROM `users` WHERE `user_name` = '{$user_name}' AND `user_password` = '{$user_password}'");
if (mysql_num_rows($result) != 1){
return false;
}
return mysql_result($result, 0);
}
?>
