<?php
require_once 'header.php';
require_once 'http.php';
if (isset($_REQUEST['action'])) {
switch($_REQUEST['action']){
case 'Login':
if (isset($_POST['passwd']))
{
$sql = "SELECT user_id, access_lvl, name " .
"FROM cms_users " .
"WHERE email='" . $_POST['email'] . "' " .
"AND passwd='" . $_POST['passwd'] . "'";
$result = mysql_query($sql, $connect)
or die('non posso ricavare le informazioni' . mysql_error());
if ($row = mysql_fetch_array($result)) {
session_start();
$_SESSION['user_id'] = $row['user_id'];
$_SESSION['access_lvl'] = $row['access_lvl'];
$_SESSION['name'] = $row['name'];
}
}
redirect('index.php');
break;
case 'Logout':
session_start();
session_unset();
session_destroy();
redirect('index.php');
break;
case 'Create account':
if (isset($_POST['name'])
and isset($_POST['email'])
and isset($_POST['passwd'])
and isset($_POST['passwd2'])
and $_POST['passwd'] == $_POST['passwd2'])
{
$sql = "INSERT INTO cms_users (email, name, passwd) " .
"VALUES ('" . $_POST['email'] . "','" .
$_POST['name'] . "','" . $_POST['passwd'] . "')";
mysql_query($sql, $connect)
or die('non posso creare il nuovo account; ' . mysql_error());
session_start();
$_SESSION['user_id'] = mysql_insert_id($connect);
$_SESSION['access_lvl'] = 1;
$_SESSION['name'] = $_POST['name'];
}
redirect('index.php');
break;
case 'Modify account':
if (isset($_POST['name'])
and isset($_POST['email'])
and isset($_POST['access_lvl'])
and isset($_POST['userid']))
{
$sql = "UPDATE cms_users " .
"SET email='" . $_POST['email'] .
"', name='" . $_POST['name'] .
"', access_lvl=" . $_POST['accesslvl'] . " " .
" WHERE user_id=" . $_POST['user_id'];
mysql_query($sql, $connect)
or die ('Non posso modificare il tuo account ' . mysql_error());
}
redirect('admin.php');
break;
case 'Semd my reminder!':
if (isset($_POST['email'])) {
$sql = "SELECT passwd FROM cms_users " .
"WHERE email='" . $_POST['email'] . "'";
$result = mysql_query($sql, $connect)
or die('Non riesco ad ultimare qusta operazione ' . mysql_error());
if (mysql_num_rows($result)) {
$row = mysql_fetch_array($result);
$subject = 'Comic site password reminder ';
$body = 'just a reminder is: ' .
$row['passwd'] .
"\n\nyou can use this log in at
http://" .
$_SERVER['HTTP_HOST'] .
dirname($_SERVER['PHP_SELF']) . '/';
mail($_POST['email'], $subject, $body)
or die('non posso concludere questa operzione ' . mysql_error());
}
}
redirect('login.php');
break;
case 'Change my info':
session_start();
if (isset($_POST['name'])
and isset($_POST['email'])
and isset($_SESSION['user_id']))
{
$sql = "UPDATE cms_users " .
"SET email='" . $_POST['email'] .
"', name='" . $_POST['name'] . "' " .
"WHERE user_id=" . $_SESSION['user_id'];
mysql_query($sql, $connect)
or die('non posso sovrascrivere il tuo account ' . mysql_error());
}
redirect('cpanel.php');
break;
} // switch
}
?>