$sq=mysql_query('select * from users where usercode=<script>document.write(js_var)</script>');
<?php require_once 'loginManager.php'; ?><?php
define ("TIMEOUT", 600) ;// timeout in seconds
new loginManager();
class loginManager{
public function loginManager(){
if (session_id() == '') session_start(); //start the session if needed
if (isLoggedIn()){
if (isset($_GET['logout'])){
logOut(true);
} else {
//do nothing, let script execution continue
return;
}
}
if (isset($_POST['loginpass'])){
//validate the password
if ($this->checkpassword($_POST['loginpass'])){
//if we have the right password then log the user in
$this->logIn();
} else {
$this->logOut();
}
} else {
$this->logOut();
}
}
//we use nonces to prevent back button/refresh resubmission of credentials
private function checkNonce(){
if (!isset($_SESSION['nonce'])){
return false;
}
if (!isset($_POST['nonce'])){
return false;
}
if ($_SESSION['nonce'] !== $_POST['nonce']){
return false;
} else {
unset($_SESSION['nonce']);
return true;
}
}
private function getNonce(){
if (isset($_SESSION['nonce'])){
} else {
$_SESSION['nonce'] = md5(uniqid(rand(), true));
}
return $_SESSION['nonce'];
}
private function logIn(){
$_SESSION['lastaccess'] = time(); //sets the timer
$_SESSION['username'] = $_POST['loginpass'];
//for debuggin
echo <<<HTML
logged in. Click <a href="{$_SERVER['PHP_SELF']}?logout">here</a> to logout
HTML;
}
private function isLoggedIn(){
if (isset($_SESSION['username'])){
if (!$this->isTimedOut()){
return true;
} else {
return false;
}
} else {
return false;
}
}
private function isTimedOut(){
if (empty($_SESSION['lastaccess'])){
return true;
}
if ((time() - TIMEOUT) >= $_SESSION['lastaccess']){
return true;
} else {
$_SESSION['lastaccess'] = time();
return false;
}
}
private function checkPassword($pwd){
if (!$this->checkNonce()) return false;
$pwd = trim ($pwd);
return ($pwd === 'password');
}
private function logOut($redirect = false){
unset($_SESSION['username']);
unset ($_SESSION['lastaccess']);
if ($redirect){
header('Location:'.$_SERVER['PHP_SELF']);
exit();
} else {
$this->displayLoginForm();
}
}
private function displayLoginForm(){
$nonce = $this->getNonce();
$form = <<<HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "[URL unfurl="true"]http://www.w3.org/TR/html4/strict.dtd">[/URL]
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Login Here</title>
<style type="text/css">
html, body, input {font-family: verdana; color: rgb(96,87,140); padding:0; margin:0; background-color: black;}
#contentWrapper {position:relative; top: 150px; width: 30%; margin: 0 auto; }
#message {border: dashed #FFFFFF 1px; background-color: #FF3300; padding-top:25px; padding-bottom: 25px;color: #FFFFFF;margin-bottom: 20px; text-align: center;}
#loginFieldset{background-color: #FFFFFF; }
#loginFieldset .button {background-color: silver; }
#loginFieldset .row {clear:both; text-align: center;}
#loginFieldset .row .field{width: 60%; margin: 0 auto;}
#loginFieldset .row .field input {background-color:#FFFFFF;}
</style>
</head>
<body>
<div id="contentWrapper">
<div id="message">
You are not authenticated. Please login.
</div>
<div id="form">
<form method="post" action="{$_SERVER['PHP_SELF']}" id="loginForm">
<fieldset id="loginFieldset">
<div class="row">
<div class="label">
<label for="loginPass">Enter your password</label>
</div>
<div class="field">
<input type="text" name="loginpass" class="midSize" id="loginPass"/>
</div>
</div>
<div class="row">
<div class="buttonDiv">
<input type="submit" name="submit" value="login" class="button"/>
</div>
</div>
<input type="hidden" name="nonce" value="$nonce"/>
</fieldset>
</form>
</div>
</div>
</body>
</html>
HTML;
echo $form;
die();
}
}
?>jebo100 said:AGREE with you guys,
i was assuming that i could use the $php_var for my query because if i echo $php_var, it returns the string i inputed from the js prompt.
but when i tested it in actual query, it didn't.
i dont really understand what happened.
echoing $php_var returns the value from js prompt variable.
but echoing str_word_count($php_var) returns 6.
it counts the words from "<script>document.write(js_var)</script>"
i wanted to use the js prompt as log in form because i wanted the form to be modal.
, what i really wanted to understand for now from the code below is, when i echo $php_var, it will return the js variable value. <script>your function</script>
echo "<form id=\"form1\" method=\"post\" action=\"whereyoursqlis.php\" target=\"_self\">" .
"<input name=\"php_var\" type=\"hidden\" value=\"$php_var\">" .
"</form><br>" .
"<body onload=\"document.getElementById('form1').submit(); return false;\">";
}
?><?
$php_var = $_POST['php_var'];
$q=mysql_query('select * from table where usercode="$php_var"')
?>
<another redirect here (meta or js)>
