<?php
require "connect.php";
 
if(isset($_GET['u'])){
//make sure that 'u' is numeric
if(is_numeric($_GET['u'])){
$u=$_GET['u'];
}else{
$u=0;
}
}
 
if(isset($_GET['a_code'])){
$code=$_GET['a_code'];
}else{
$code=0;
}
 
//Check to see if the received values are correct
$sql = "SELECT * FROM members WHERE uid = '".$u."' AND actcode = '".md5(0)."'";
if(($u > 0) && (strlen($code)) == 32){
 
//now activate the user
$sql="UPDATE members SET actcode ='".md5(1)."' WHERE uid = '".$u."'";
 
$res = mysql_query($sql) or die(mysql_error());
 
if(mysql_affected_rows() == 1){
 
//update successful
echo ('Your account is now activated. You may proceed and log in.<br/><br /><a href="http://www.eternalhour.com/login.php">Login Page</a>');
}else{
echo ('Your account could not be activated. Please try again or contact the site admin.<br/><br/><a href="http://www.eternalhour.com/registration_form.php">Registration Page</a>');
}
}
?>

if(isset($_GET['u'])){
$u=$_GET['u'];
}
 
$sql = "SELECT * FROM members WHERE uid = '".$u."' AND actcode = '".md5."'";
if($row['actcode']) == (md5(1)){
 
}else{
$msg = "You need to activate your account before logging in.";
}

//this is after form validates and you are about to insert the data into the database
function randString( $length ) {
	$array = array("b","c","d","f","g","h","j","k","l","m","n","p","q","r","s","t","v","w","x","y","z","B","C","D","F","G","H","J","K","L","M","N","P","Q","R","S","T","V","W","X","Y","Z","0","1","2","3","4","5","6","7","8","9");
	$i = 0;
	$code = '';
	while ( $i < $length ) {
		$rand = rand( 0,( count( $array ) - 1 ) );
		$code .= $array[$rand];
	$i++;
	}
	return $code;
}
$code = randString(50);
mysql_query("INSERT INTO `members` (....column names....,'active') VALUES (....values here....,'{$code}')") or die(mysql_error()); //shows how you insert the code
$message = "Welcome to something.com,\n\nTo activate your account click the link below:\n\nhttp://www.something.com/activate.php?id=" . mysql_insert_id() . "&code={$code}\n\nBest regards,\n\nAdmin\nSomething.com (info@something.com)";
mail('email of user from form','Email Confirmation',$message,"From: Something.net<no-reply@something.net>"); //sends the activation email with the id of the user and activation code.

if ( isset( $_GET['id'],$_GET['code'] ) ) {
  $id = (int) $_GET['id'];
  $code = mysql_real_escape_string( $_GET['code'] );
  $query = mysql_query("SELECT `active` FROM `members` WHERE `id` = {$id}");
  if ( mysql_num_rows( $query ) == 1 ) {
    list( $active ) = mysql_fetch_rows( $query );
    if ( $active == 1 ) {
       die('User account has already been activated');
    }
    elseif ( $active == $code ) {
      mysql_query("UPDATE `members` SET `active` = 1 WHERE `id` = {$id}"); //sets the member to active.
    }
    else {
      die('Invalid activation code');
    }
  }
  else {
    die('User not found!');
  }
}
else {
  die('Malformed URL');
}

if ( isset( $_GET['id'],$_GET['code'] ) ) {
  $id = (int) $_GET['id'];
  $code = mysql_real_escape_string( $_GET['code'] );
  $query = mysql_query("SELECT `active` FROM `members` WHERE `id` = {$id}");
 
if($row['active']) == 1){
 
}else{
 
$msg = "You need to activate your account before logging in.";
 
}

$username = mysql_real_escape_string( $_POST['user'] ); //username from form
$query = mysql_query("SELECT `password`,`active` FROM `table_name` WHERE `username` = '{$user}' LIMIT 1");
if ( mysql_num_rows( $query ) == 0 ) {
  $msg = 'Username and/or Password incorrect'; //never be specific
}
else {
  list( $password,$active ) = mysql_fetch_row( $query );
  if ( $active !== 1 ) {
    $msg = 'You need to activate your account before logging in.';
  }
  else {
    //check the password and set login session here. Your passwords should be hashed.
  }
}