<?php
/* Program: Login.php
* Desc: Login program for the Members Only section of the
* pet store. It provides two options: (1) login
* using an existing Login Name and (2) enter a new
* login name. Login Names and passwords are stored
* in a MySQL database.
*/
session_start();
include("dogs.inc");
switch (@$_GET['do'])
{
case "login":
$connection = mysql_connect($host, $user,$password)
or die ("Couldn’t connect to server.");
$db = mysql_select_db($database, $connection)
or die ("Couldn’t select database.");
$sql = "SELECT loginName FROM Member
WHERE loginName='$_POST[fusername]'";
$result = mysql_query($sql)
or die("Couldn't execute query.");
$num = mysql_num_rows($result);
if ($num == 1) // login name was found
{
$sql = "SELECT loginName FROM Member
WHERE loginName='$_POST[fusername]'
AND password=password('$_POST[fpassword]')";
$result2 = mysql_query($sql)
or die("Couldn't execute query 2.");
$num2 = mysql_num_rows($result2);
if ($num2 > 0) // password is correct
{
$_SESSION['auth']="yes";
$logname=$_POST['fusername'];
$_SESSION['logname'] = $logname;
$today = date("Y-m-d h:m:s");
$sql = "INSERT INTO Login (loginName,loginTime)
VALUES ('$logname','$today')";
mysql_query($sql) or die("Can't execute query.");
header("Location: Member_page.php");
}
else // password is not correct
{
unset($do);
$message="The Login Name, '$_POST[fusername]'
exists, but you have not entered the
correct password! Please try
again.<br>";
include("login_form.inc");
}
}
elseif ($num == 0) // login name not found
{
unset($do);
$message = "The Login Name you entered does not
exist! Please try again.<br>";
include("login_form.inc");
}
break;
case "new":
foreach($_POST as $field => $value)
{
if ($field != "fax")
{
if ($value == "")
{
unset($_GET['do']);
$message_new = "Required information is missing.
Please try again.";
include("login_form.inc");
exit();
}
}
if (ereg("(Name)",$field))
{
/*if (!ereg("^[A-Za-z' -]{1,50}$",$value))
{
unset($_GET['do']);
$message_new = "$field is not a valid name.
Please try again.";
include("login_form.inc");
exit();
}*/
}
$$field = strip_tags(trim($value));
} // end foreach
if (!ereg("^[0-9]{5,5}(\-[0-9]{4,4})?$",$zip))
{
unset($_GET['do']);
$message_new = "$zip is not a valid zip code.
Please try again.";
include("login_form.inc");
exit();
}
if (!ereg("^[0-9)(xX -]{7,20}$",$phone))
{
unset($_GET['do']);
$message_new = "$phone is not a valid phone number.
Please try again.";
include("login_form.inc");
exit();
}
if ($fax != "")
{
if (!ereg("^[0-9)(xX -]{7,20}$",$fax))
{
unset($_GET['do']);
$message_new = "$fax is not a valid phone number.
Please try again.";
include("login_form.inc");
exit();
}
}
if (!ereg("^.+@.+\\..+$",$email))
{
unset($_GET['do']);
$message_new = "$email is not a valid email address.
Please try again.";
include("login_form.inc");
exit();
}
/* check to see if login name already exists */
$connection = mysql_connect($host,$user,$password)
or die ("Couldn't connect to server.");
$db = mysql_select_db($database, $connection)
or die ("Couldn't select database.");
$sql = "SELECT loginName FROM Member
WHERE loginName='$newname'";
[color=red]$result = mysql_query($sql)
or die ("this is where it fails.");[/color]
$num = mysql_numrows($result);
if ($num > 0)
{
unset($_GET['do']);
$message_new = "$newname already used. Select another
Member ID.";
include("login_form.inc");
exit();
}
else
{
$today = date("Y-m-d");
$sql = "INSERT INTO Member (loginName,createDate,
password,firstName,lastName,street,city,
state,zip,phone,fax,email) VALUES
('$newname','$today',password('$newpass'),
'$firstName', '$lastName','$street','$city',
'$state','$zip','$phone','$fax','$email')";
mysql_query($sql);
$_SESSION['auth']="yes";
$_SESSION['logname'] = $newname;
/* send email to new member */
$emess = "A new Member Account has been setup. ";
$emess.= "Your new Member ID and password are: ";
$emess.= "\n\n\t$newname\n\t$newpass\n\n";
$emess.= "We appreciate your interest in Pet Store";
$emess.= " at PetStore.com. \n\n";
$emess.= "If you have any questions or problems,";
$emess.= " email webmaster@petstore.com";
$ehead="From: member-desk@petstore.com\r\n";
$subj = "Your new Member Account from Pet Store";
$mailsend=mail("$email","$subj","$emess","$ehead");
header("Location: New_member.php");
}
break;
default:
include("login_form.inc");
}
?>
