// Blog Script - File Name : login.php // Copyright (C) myBloggie Sean // http://www.mywebland.com , http://mybloggie.mywebland.com // You are requested to retain this copyright notice in order to use // this software. //This program is free software; you can redistribute it and/or //modify it under the terms of the GNU General Public License //as published by the Free Software Foundation; either version 2 //of the License, or (at your option) any later version. //This program is distributed in the hope that it will be useful, //but WITHOUT ANY WARRANTY; without even the implied warranty of //MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the //GNU General Public License for more details. //You should have received a copy of the GNU General Public License //along with this program; if not, write to the Free Software //Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. define('IN_MYBLOGGIE', true); $mybloggie_root_path = './'; include_once($mybloggie_root_path.'config.php'); include_once($mybloggie_root_path.'includes/db.php'); include_once($mybloggie_root_path.'includes/template.php'); include_once($mybloggie_root_path.'includes/function.php'); include_once($mybloggie_root_path.'language/lang_eng.php'); include_once($mybloggie_root_path.'common.php'); //214 $tabcolor='#efefef'; if (isset($_GET['mode'])) { $mode = htmlspecialchars($_GET['mode']) ; } // Security precaution - sean 07 Oct 2005 if (isset($_POST['username'])) { $username=$_POST['username']; } else $username=""; if (isset($_POST['passwd'])) { $passwd = $_POST['passwd']; } else $passwd = ""; $username = htmlspecialchars(rtrim(trim($username), "\\")); $username = substr(str_replace("\\'", "'", $username), 0, 25); $username = str_replace("'", "\\'", $username); if( isset( $mode ) ) { if( $mode == "login" ) { $username = trim( $username ); $passwd = md5(trim( $passwd )); if( $username == "" ) message( $lang['Error'] , $lang['Msg_enter_name'] ); if( $passwd == "" ) message($lang['Error'], $lang['Msg_enter_pass'] ); $result = mysql_query( "SELECT user FROM ".USER_TBL." WHERE user='$username' AND password='$passwd'" ) or error( mysql_error() ); if( mysql_num_rows( $result ) != 1 ) { ?>