register.php
<?php
include ('core/init.inc.php');
$errors = array();
if (isset($_POST['username'], $_POST['password'], $_POST['repeat_password']))
{
if (empty($_POST['username']))
{
$errors[] = 'The username cannot be empty.';
}
if (empty($_POST['password']) || empty($_POST['repeat_password']))
{
$errors[] = 'The password cannot be empty.';
}
if ($_POST['password'] !== $_POST['repeat_password'])
{
$errors [] = 'Password verification failed.';
}
if(user_exists($_POST['username']))
{
$errors[] = 'The username you entered is already taken.';
}
if(empty($errors))
{
add_user($_POST['username'], $_POST['password']);
$_SESSION['username'] = htmlentities($_POST['username']);
$result = mysql_query("SELECT (`user_id`) FROM `users` WHERE `user_username` = '{$_SESSION['username']}'");
$_SESSION['uid'] = mysql_result($result);#
$uid=$_SESSION['uid'];
header("Location: profile.php?uid=" . $_SESSION['uid']);
die();
}
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Register New User</title>
</head>
<body>
<p>
<?php
if(empty($errors) === false)
{
?>
<ul>
<?php
foreach($errors as $error)
{
echo "<li>{$error}</li>";
}
?>
</ul>
<?php
}
?>
</p>
<p>
<form action="" method="post"/>
<p>
<label for="username">Username: </label>
<input type ="text" name="username" id="username" value="<?php if (isset($_POST['username'])) echo htmlentities($_POST['username']); ?>"/>
</p>
<p>
<label for="password">Password: </label>
<input type ="password" name="password" id="password"/>
</p>
<p>
<label for="repeat_password">Repeat Password: </label>
<input type ="password" name="repeat_password" id="repeat_password"/>
</p>
<input type="submit" value="Register" />
</body>
</html>
login.php
<?php
include('core/init.inc.php');
$errors = array();
if (isset($_POST['username'], $_POST['password']))
{
if (empty($_POST['username']))
{
$errors[] = 'The username cannot be empty.';
}
if (empty($_POST['password']))
{
$errors = 'The password cannot be empty.';
}
if (valid_credentials($_POST['username'], $_POST['password']) === false)
{
$errors = 'Username/Password incorrect.';
}
if (empty($errors))
{
$_SESSION['username'] = htmlentities($_POST['username']);
$result = mysql_query("SELECT (`user_id`) FROM `users` WHERE `user_username` = '{$_SESSION['username']}'");
$_SESSION['uid'] = mysql_result($result);
$uid=$_SESSION['uid'];
header("Location: profile.php?uid=['$uid']");
die();
}
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title></title>
</head>
<body>
<div>
<?php
if (empty($errors) == false)
{
?>
<ul>
<?php
foreach ($errors as $error)
{
echo "<li>($error)</li>";
}
?>
</ul>
<?php
}
else
{
echo 'Need an account? <a href="register.php">Register here</a>';
}
?>
</div>
<form name="login" action="" method="post">
<p>
<label for="username">Username: </label>
<input type="text" name="username" id="username" value="<?php if (isset($_POST['username'])) echo htmlentities($_POST['username']); ?>" />
</p>
<p>
<label for="password">Password: </label>
<input type="password" name="password" id="password" />
</p>
<p>
<input type="submit" value="Login" />
</p>
</form>
</body>
</html>
profile.php
<?php
include('core/init.inc.php');
$userinfo = fetch_user_info($_GET['uid']);
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title><?php echo $userinfo ['username']; ?>'s Profile</title>
</head>
<body>
<div>
<?php
if($userinfo == false)
{
echo 'Sorry, the user does not exist.';
echo "the following variable is ".$_SESSION['uid'];
}
else
{
?>
<h1><?php echo $userinfo ['firstname']; ?> <?php echo $userinfo ['lastname']; ?></h1>
<p>Username: <?php echo $userinfo ['username']; ?></p>
<p>First Name: <?php echo $userinfo ['firstname']; ?></p>
<p>Last Name: <?php echo $userinfo ['lastname']; ?></p>
<p>Gender: <?php echo ($userinfo ['gender'] == 1) ? 'Male' : 'Female'; ?></p>
<p>Email: <?php echo $userinfo ['email']; ?></p>
<p>Location: <?php echo $userinfo ['location']; ?></p>
<p>About: <?php echo $userinfo ['about']; ?></p>
</div>
<?php
}
?>
</body>
</html>
userinc.php
<?php
//'SELECT user_id AS "id", user_username AS "username" FROM users'
//fetches all of the users from the table
function fetch_users()
{
$query = 'SELECT user_id, user_username FROM users';
$result = mysql_query('SELECT user_id AS `id`, user_username AS `username` FROM users');
$users = array();
while(($row = mysql_fetch_assoc($result)) !==false)
{
$users[] = $row;
}
return $users;
}
//fetches profile information for the given user
function fetch_user_info($uid)
{
$uid=(int)$uid;
$sql = "SELECT
`user_username` AS `username`,
`user_firstname` AS `firstname`,
`user_lastname` AS `lastname`,
`user_email` AS `email`,
`user_location` AS `location`,
`user_about` AS `about`,
`user_gender` AS `gender`
FROM `users`
WHERE `user_id` = {$uid}";
$result = mysql_query($sql);
return mysql_fetch_assoc($result);
}
//updates the current users profile info
function set_profile_info($email, $location,$about)
{
$email = mysql_escape_string(htmlentities($email));
$about = mysql_escape_string(nl2br(htmlentities($about)));
$location = mysql_escape_string($location);
$sql = "UPDATE `users` SET
`user_email` = '{$email}',
`user_about` = '{$about}',
`user_location` = '{$location}'
WHERE `user_id` = {$_SESSION['uid']}";
mysql_query($sql);
}
//checks if the given username exists in the database
function user_exists($user)
{
$user = mysql_real_escape_string($user);
$total = mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `user_username` = '{$user}'");
return (mysql_result($total, 0) == '1') ? true : false;
}
//checks if the given username and password combination is valid
function valid_credentials($user, $pass)
{
$user = mysql_real_escape_string($user);
$pass = sha1($pass);
$total = mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `user_username` = '{$user}' AND `user_password = '{$pass}'");
return (mysql_result($total, 0) == '1') ? true : false;
}
//adds a user to the datatabase
function add_user($user, $pass)
{
$user = mysql_real_escape_string(htmlentities($user));
$pass = sha1($pass);
mysql_query("INSERT INTO `users` (`user_username`, `user_password`) VALUES ('{$user}', '{$pass}')");
}
?>
