nope
init
<?php
session_start ();
mysql_connect("??????????????????????","????????????????","?????????????");
mysql_select_db("???????????");
$path = dirname(__FILE__);
include ("{$path}/init/user.inc.php");
if (isset($_COOKIE['username'], $_COOKIE['password']) && isset($_SESSION['username']) === false){
if (valid_credentials($_COOKIE['username'], $_COOKIE['password'])){
$_SESSION['username'] = htmlentities($_COOKIE['username']);
setcookie('username', $_COOKIE['username'], time() + 604800);
setcookie('password', $_COOKIE['password'], time() + 604800);
}
}
if (isset($_SESSION['username'])){
$_SESSION['uid'] = fetch_current_user_id($_SESSION['username']);
}
?>
user.inc
<?php
error_reporting(E_ALL);
//fetches the current logged in users id
function fetch_current_user_id($username){
$username = mysql_real_escape_string($username);
$sql = "SELECT `user_id` FROM `users` WHERE `user_username` = '{$username}'";
$result = mysql_query($sql);
return mysql_result($result, 0);
}
//check if given username exsists in the database
function user_exists($user){
$user = mysql_real_escape_string($user);
$total = mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `user_username` = '{$user}'");
echo mysql_error();
return (mysql_result($total, 0) == '1') ? true : false;
}
//check if the given username and password combinations are valid
function valid_credentials($user, $pass){
$user = mysql_real_escape_string($user);
$pass = mysql_real_escape_string($pass);
$total = mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `user_username` = '{$user}' AND `user_password` = '{$pass}'");
return (mysql_result($total, 0) == '1') ? true : false;
}
//checks to see is user account is active
function is_active($user){
$user = mysql_real_escape_string($user);
echo mysql_error();
$sql = "SELECT
COUNT(`activations`.`user_id`)
FROM `users`
INNER JOIN `activations`
ON `users`.`user_id` = `activations`.`user_id`
WHERE `users`.`user_username` = '{$user}'";
$result = mysql_query($sql);
return (mysql_result($result, 0) == '0') ? true : false;
}
//acctivates the account related to the given activation code
function activate_account($aid){
$aid = mysql_real_escape_string($aid);
mysql_query("DELETE FROM `activations` WHERE `activation_code` = '{$aid}'");
echo mysql_error();
}
//adds a user to the database
function add_user($user, $email, $pass, $first, $last){
$user = mysql_real_escape_string(htmlentities($user));
$email = mysql_real_escape_string($email);
$pass = sha1($pass);
$first = mysql_real_escape_string(htmlentities($first));
$last = mysql_real_escape_string(htmlentities($last));
$charset = array_flip(array_merge(range('a', 'z'), range('A', 'Z'), range('0', '9')));
$aid =implode('', array_rand($charset, 10));
$body = <<<EMAIL
Thank you for signing up with knowquest. To activate your account, please click the link below:
http://www.jasonmassieportfolio.com/act ... ?aid={$aid}
EMAIL;
mail($email, 'Your new account at Knowquest.com', $body, 'From: admin@knowquest.com');
mysql_query("INSERT INTO `users` (`user_username`, `user_email`, `user_password`,`user_firstname`,`user_lastname`) VALUES ('{$user}', '{$email}', '{$pass}','{$first}','{$last}')");
echo mysql_error();
$user_id = mysql_insert_id();
mysql_query("INSERT INTO `activations` (`user_id`, `activation_code`) VALUES ({$user_id}, '{$aid}')");
echo mysql_error();
}
//fetches all of the users from the table
function fetch_users(){
$result = mysql_query("SELECT `user_id` AS `id`, `user_username` AS `username` FROM `users`");
$users = array();
while (($row = mysql_fetch_assoc($result)) !== false){
$users[] = $row;
}
return $users;
}
//fetches profile info for given user
function fetch_user_info($uid){
$uid = (int)$uid;
$sql = "SELECT
`user_id` AS `id`,
`user_username` AS `username`,
`user_email` AS `email`,
`user_firstname` AS `firstname`,
`user_lastname` AS `lastname`,
`user_institution` AS `institution`,
`user_department` AS `department`,
`user_location` AS `location`,
`user_speciality` AS `speciality`,
`user_key words` AS `keywords`,
`user_research centre` AS `researchcentre`,
`user_website` AS `website`,
`user_articles published pre` AS `articlespublishedpre`,
`user_articles published non pre` AS `articlespublishednonpre`,
`user_published books` AS `publishedbooks`,
`user_social media` AS `socialmedia`,
`user_published chapters` AS `publishedchapters`,
`user_confidence proceedings` AS `confidenceproceedings`,
`user_non acidemic influences` AS `nonacidemicinfluences`,
`user_data sets` AS `datasets`,
`user_research methodology perferred` AS `researchmethodologyperferred`,
`user_researchers cited in your research` AS `researcherscitedinyourresearch`,
`user_memberships` AS `memberships`,
`user_acidemic influences` AS `acidemicinfluences`
FROM `users`
WHERE `user_id` = {$uid}";
$result = mysql_query($sql);
echo mysql_error();
$info = mysql_fetch_assoc($result);
$info['avatar'] = (file_exists("{$GLOBALS['path']}/user_avatars/{$info['id']}.jpg")) ? "core/user_avatars/{$info['id']}.jpg" : "core/user_avatars/default.jpg";
return $info;
}
//updates current user portfolio info
function set_profile_info($email, $institution, $department, $location, $speciality, $keywords, $researchcentre, $website, $articlespublishedpre, $articlespublishednonpre, $publishedbooks, $socialmedia, $publishedchapters, $confidenceproceedings, $nonacidemicinfluences, $datasets, $researchmethodologyperferred, $researcherscitedinyourresearch, $memberships, $acidemicinfluences, $avatar){
$email = mysql_real_escape_string(htmlentities($email));
$institution = mysql_real_escape_string(htmlentities($institution));
$department = mysql_real_escape_string(htmlentities($department));
$location = mysql_real_escape_string(htmlentities($location));
$speciality = mysql_real_escape_string(htmlentities($speciality));
$keywords = mysql_real_escape_string(htmlentities($keywords));
$researchcentre = mysql_real_escape_string(htmlentities($researchcentre));
$website = mysql_real_escape_string(htmlentities($website));
$articlespublishedpre = mysql_real_escape_string(htmlentities($articlespublishedpre));
$articlespublishednonpre = mysql_real_escape_string(htmlentities($articlespublishednonpre));
$publishedbooks = mysql_real_escape_string(htmlentities($publishedbooks));
$socialmedia = mysql_real_escape_string(htmlentities($socialmedia));
$publishedchapters = mysql_real_escape_string(htmlentities($publishedchapters));
$confidenceproceedings = mysql_real_escape_string(htmlentities($confidenceproceedings));
$nonacidemicinfluences = mysql_real_escape_string(htmlentities($nonacidemicinfluences));
$datasets = mysql_real_escape_string(htmlentities($datasets));
$researchmethodologyperferred = mysql_real_escape_string(htmlentities($researchmethodologyperferred));
$researcherscitedinyourresearch = mysql_real_escape_string(htmlentities($researcherscitedinyourresearch));
$memberships = mysql_real_escape_string(htmlentities($memberships));
$acidemicinfluences = mysql_real_escape_string(htmlentities($acidemicinfluences));
if (file_exists($avatar)){
$src_size = getimagesize($avatar);
if ($src_size['mime'] === 'image/jpeg'){
$src_img = imagecreatefromjpeg($avatar);
}else if ($src_size['mime'] === 'image/png'){
$src_img = imagecreatefrompng($avatar);
}else if ($src_size['mime'] === 'image/gif'){
$src_img = imagecreatefromgif($avatar);
}else{
$src_img = false;
}
if ($src_img !== false){
$thumb_width = 200;
if ($src_size[0] <= $thumb_width){
$thumb = $src_img;
}else{
$new_size[0] = $thumb_width;
$new_size[1] = ($src_size[1] / $src_size[0]) * $thumb_width;
$thumb = imagecreatetruecolor($new_size[0], $new_size[1]);
imagecopyresampled($thumb, $src_img, 0, 0, 0, 0, $new_size[0], $new_size[1], $src_size[0], $src_size[1]);
}
imagejpeg($thumb, "{$GLOBALS['path']}/user_avatars/{$_SESSION['uid']}.jpg");
}
}
$sql = "UPDATE `users` SET
`user_email` = '{$email}',
`user_institution` = '{$institution}',
`user_department` = '{$department}',
`user_location` = '{$location}',
`user_speciality` = '{$speciality}',
`user_key words` = '{$keywords}',
`user_research centre` = '{$researchcentre}',
`user_website` = '{$website}',
`user_articles published pre` = '{$articlespublishedpre}',
`user_articles published non pre` = '{$articlespublishednonpre}',
`user_published books` = '{$publishedbooks}',
`user_social media` = '{$socialmedia}',
`user_published chapters` = '{$publishedchapters}',
`user_confidence proceedings` = '{$confidenceproceedings}',
`user_non acidemic influences` = '{$nonacidemicinfluences}',
`user_data sets` = '{$datasets}',
`user_research methodology perferred` = '{$researchmethodologyperferred}',
`user_researchers cited in your research` = '{$researcherscitedinyourresearch}',
`user_memberships` = '{$memberships}',
`user_acidemic influences` = '{$acidemicinfluences}'
WHERE `user_id` = {$_SESSION['uid']}";
mysql_query($sql);
echo mysql_error();
}
//checks if the given user id is in the table
function valid_uid($uid){
$uid = (int)$uid;
$total = mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `user_id` = {$uid}");
$total = mysql_result($total, 0);
if ($total != 1){
return false;
}else{
return true;
}
}
//fetches a single user from the table
function get_user($uid){
$uid = (int)$uid;
$sql = "SELECT
`user_id` AS `uid`
FROM `users`
WHERE `user_id` = {$uid}";
$post = mysql_query($sql);echo mysql_error();
$post = mysql_fetch_assoc($post);
$post['comments'] = get_comments($uid);
return $post;
}
//fetches all the comments for a given user wall post
function get_wall_comments($uid){
$uid = (int)$uid;
$sql = "SELECT
`comment_body` AS `body`,
`comment_user` AS `user`,
DATE_FORMAT(`comment_date`, '%d/%m/%Y %H:%i:%s') AS `date`
FROM `wallcomments`
WHERE `user_id` = {$uid}";
$comments = mysql_query($sql);
$return = array();
while (($row = mysql_fetch_assoc($comments)) !== false){
$return[] = $row;
}
return $return;
}
//add a wall comment
function add_wall_comment($uid, $body, $user){
if (valid_uid($uid) === false){
return false;
}
$uid = (int)$uid;
$body = mysql_real_escape_string(nl2br(htmlentities($body)));
$user = mysql_real_escape_string(htmlentities($user));
mysql_query("INSERT INTO `wallcomments` (`user_id`, `comment_body`, `comment_user`, `comment_date`) VALUES ('{$uid}', '{$user}', '{$body}', NOW())");
return true;
}
//Searches users
function search_users($uid){
$keywords = preg_split('#\s+#', mysql_real_escape_string($uid));
if(empty($keywords)){
return array();
}
$uid_where = "`user_id` LIKE '%" . implode("%' OR `user_id` LIKE '%", $keywords) . "%'";
$username_where = "`user_username` LIKE '%" . implode("%' OR `user_username` LIKE '%", $keywords) . "%'";
$sql = "SELECT
`user_id` AS `uid`
LEFT (`user_username`, 100) AS `users`
FROM `users`
WHERE {$username_where}
OR {$uid_where}";
$result = mysql_query($sql);echo mysql_error();
$results = array();
while(($row = mysql_fetch_assoc($result)) !== false){
$results[] = $row;
}
return $results;
}
?>
search
<form action="" method"get">
Prof. Finder
<input type="text" size="30" name="usrename" />
<input type="submit" value="search" />
</form>
<p> </p>
<p>
<?php
if (empty($_GET['username']) === false){
$search_results = search_users($_GET['username']);
if (empty($search_results)){
echo "Your search came up with 0 results";
}
foreach ($search_results as $result){
echo "<h3>{$result['username']}</h3>";
}
}
?>
it looks all fine to me