<?php
function show_login_form($username,$password,$regcode)
{
?>
<h1>Login</h1>
<p>
Login by typing your username and password into
the boxes below and clicking on the 'Login' button.
Your username must match your IK account username <b>exactly</b>
and the password <b>must be different</b>.
</p>
<form action="login.php" method="post">
<table border=0 cellpadding=0 cellspacing=0>
<tr>
<td align="right">Username:
<Input type=text name=username value="<?echo stripslashes($username)?>" class=textinput>
</td>
</tr>
<tr>
<td align="right">Password:
<Input type=password name=password value="" class=textinput>
</td>
</tr>
<tr>
<td> </td>
</tr>
<tr>
<td align="right">
<input type=submit name=submit value="Login">
</td>
</tr>
</table>
<p>
If you do not have an account, please click <a href="register.php">here</a>
to register an account, or if you have a registration code, enter it here:
<input type=text name=regcode size=5 value="<?echo stripslashes($regcode);?>" class=textinput>.
</p>
</form>
<?
}
function prepare_failed_alert($failedattempts)
{
if ($failedattempts == 1)
{
$string = "Warning, there has been a failed attempt ";
}
else
{
$string = "Warning, there have been $failedattempts failed attempts ";
}
$string .= "to log into your account.";
$_SESSION['head_message'] .= $string;
}
function process_groups()
{
// now we'll get the group memberships
$groups="groupfileeveryone";
// set the session variables for the groups you want to check. If found it will
// contain a positive number, if not, it will contain FALSE and the existance of
// it can be checked with:
//
// if ($_SESSION["variable"])
//
$_SESSION['group_all']=strpos($groups,"everyone");
}
function authenticate($username,$password,$regcode)
{
require_once ("usersql.php");
$loginwhere=$_SERVER['REMOTE_ADDR'];
$loginwhen=date("Y/m/d H:i:s",time());
$loginconn=mysql_connect($userhost,$useruser,$userpass);
mysql_select_db($userdb,$loginconn);
$query="SELECT * FROM $usertable WHERE username='$username' AND password='$password'";
$result=mysql_query($query,$loginconn);
if(mysql_num_rows($result))
{
$loginrow=mysql_fetch_array($result);
$failedattempts=$loginrow['failedattempts'];
$dbregcode=$loginrow['userreqcode'];
if ($dbregcode=="")
{
$query="UPDATE $usertable SET lastloginwhere='$loginwhere', failedattempts='0',
lastloginwhen='$loginwhen' WHERE username='$username'";
$result=mysql_query($query,$loginconn);
$_SESSION['username']=$myrow['username'];
process_groups();
if ($failedattempts > 0)
{
prepare_failed_alert($failedattempts);
}
if ($regcode != "")
{
$_SESSION['alert'] .= "You don't need to enter the registration code any more";
}
return true;
} // end if dbregcode is empty
else
{
if ($dbregcode == $regcode)
{
$query="UPDATE $usertable SET userreqcode='', lastloginwhere='$loginwhere',
active='1', useractivated='$loginwhen', failedattempts='0',
lastloginwhen='$loginwhen' WHERE username='$username'";
$result=mysql_query($query,$loginconn);
if ($failedattempts > 0)
{
prepare_failed_alert($failedattempts);
} // end failed attempts
$_SESSION['username']=$myrow['username'];
process_groups();
return true;
} // end if the regcode matched
else
{
$_SESSION['alert'] = "You need to enter the registration code as well";
return false;
} // end if the regcode didn't match
} // end else not empty
}
else
{
// let's see if the username was valid
$query="SELECT * FROM $usertable WHERE username='$username'";
$result=mysql_query($query,$loginconn);
if(mysql_num_rows($result))
{
$loginrow=mysql_fetch_array($result);
$failedattempts=$loginrow['failedattempts'];
$failedattempts++;
$query="UPDATE $usertable SET failedattempts='$failedattempts'
WHERE username='$username'";
$result=mysql_query($query,$loginconn);
} // end if we found a valid username
$_SESSION['alert'] = "Invalid Username and Password, please try again";
return false;
}
}
?> 
