Module 03 Course Project - Developer - Building the Website

MMALIK/include/controller.php

<?php include 'conn.php'; $id = $mobileErr= $answereErr = $questionseErr = $role = $user_id = $cpass = $user = $pass = $repass = $status = $usernameErr = $passwordErr = ""; // Sanitation function clean($data) { $data = trim($data); $data = stripslashes($data); $data = htmlspecialchars($data); return $data; } // Null Validation if ($_SERVER["REQUEST_METHOD"] == "POST") { if (empty($_POST["username"])) { $usernameErr = "Userame is required"; } else { $username = clean($_POST["username"]); } if (empty($_POST["password"])) { $passwordErr = "Password is required"; } else { $password = clean($_POST["password"]); } if (empty($_POST["repass"])) { $repassErr = "Password is required"; } else { $repass = clean($_POST["repass"]); } if (empty($_POST["current"])) { $repassErr = "Password is required"; } else { $cpass = clean($_POST["current"]); } if (empty($_POST["role"])) { $roleErr = "Role is Required"; } else { $role = clean($_POST["role"]); } if (empty($_POST["secanswer"])) { $answereErr = "Answer is Required"; } else { $answer = clean($_POST["secanswer"]); } if (empty($_POST["questions"])) { $questionseErr = "Questions is Required"; } else { $question = clean($_POST["questions"]); } if (empty($_POST["phone"])) { $mobileErr = "Mobile Number is Required"; } else { $mobile = clean($_POST["phone"]); } } // Registration Query if(isset($_POST['reg'])){ $stmt = $conn->prepare("SELECT * FROM user WHERE username=:username "); $stmt->bindParam(':username',$username); $stmt->execute(); $row = $stmt->fetch(); if($row>0){ $usernameErr = "* Unavailable"; } elseif($mobile == $row['mobile_no']) { $status = "* Mobile Number is already taken"; } elseif($password != $repass) { $passwordErr = "* Not Match!"; } else { $stmt = $conn->prepare("INSERT INTO user (username, password, security_question_id, security_answer, mobile_no, activation_code) VALUES (:username, :hash, :question, :answer, :mobile, :activation_code) "); $stmt->bindParam(':username', $username); $stmt->bindParam(':hash', $hash); $stmt->bindParam(':question', $question); $stmt->bindParam(':answer', $hashanswer); $stmt->bindParam(':mobile', $mobile); $stmt->bindParam(':activation_code', $activation); $activation = uniqid(); $hashanswer = dbtest($answer, PASSWORD_DEFAULT); $hash = dbtest($password, PASSWORD_DEFAULT); $stmt->execute(); $status = "Registration Success"; } } // Activation if(isset($_GET['activate'])){ $stmt = $conn->prepare("UPDATE user SET status='active' WHERE activation_code=:activation"); $stmt->bindParam(':activation',$activation); $activation = $_GET['activation_code']; // execute the query $stmt->execute(); $status = "Activated"; } // Login Query if(isset($_POST['login'])){ $stmt = $conn->prepare("SELECT * FROM user WHERE username=:username"); $stmt->bindParam(':username',$username); $stmt->execute(); $row = $stmt->fetch(); if($row>0){ $stmt->bindParam(':password',$password); if(password_verify($password, $row['password'])){ if($row['status'] == 'active'){ $_SESSION['username']=$row['username']; $_SESSION['role'] = $row['role']; header("location:index.php"); } else { $status = "Account is Inactive please Activate your account <a href='activation.php'>HERE</a> "; } } else { $status = "Invalid Credentials!"; } } else { $status = "Invalid Credentials!"; } } // Change Password Query if(isset($_POST['changepass'])){ $stmt = $conn->prepare("SELECT password FROM user WHERE username=:username "); $stmt->bindParam(':username',$session_username); $stmt->execute(); $row = $stmt->fetch(); if($row>0){ if(password_verify($cpass, $row['password'])){ if($password == $repass) { $stmt = $conn->prepare("UPDATE user SET password=:hash WHERE username='$session_username' "); $stmt->bindParam(':hash', $hash); $hash = dbtest($password, PASSWORD_DEFAULT); $stmt->execute(); echo "<script type=\"text/javascript\"> alert(\"Password Updated!.\"); window.location = \"index.php\" </script>"; } else { $status = "Password Not Match!"; } } else { $status = "Password Incorrect!"; } } } // Cancel if(isset($_POST['cancel'])){ header("location:index.php"); } // Display All User Except Deleted function alluser(){ include 'conn.php'; $stmt = $conn->prepare("SELECT * FROM user WHERE status!='delete' "); $stmt->execute(); while($row = $stmt->fetch()){ $user_id = $row['user_id']; $username = $row['username']; $role = $row['role']; $status = $row['status']; $question = $row['security_question_id']; echo " <tr> <td>$username</td> <td>$role</td> <td> <a href='index.php?$status=$user_id' ><button class='default'>$status</button></a></td> <td>$question</td> <td> <a href='edit.php?id=$user_id'><button class='warning half'>Edit</button></a> <a href='index?del=$user_id'><button class='danger half'>Delete</button></a> </td> </tr> "; } } // Deactivate Query if(isset($_GET['active'])){ if($session_role=='Admin' || $session_role=='Dev'){ $id=$_GET['active']; $stmt = $conn->prepare("UPDATE user SET status='inactive' WHERE user_id='$id' AND username!='$session_username'"); $stmt->execute(); header('location:index.php'); } else { echo "<script type=\"text/javascript\"> alert(\"Not Authorize.\"); window.location = \"index.php\" </script>"; } } // Activate Query if(isset($_GET['inactive'])){ if($session_role=='Admin' || $session_role=='Dev'){ $id=$_GET['inactive']; $stmt = $conn->prepare("UPDATE user SET status='active' WHERE user_id='$id' AND username!='$session_username' "); $stmt->execute(); header('location:index.php'); } else { echo "<script type=\"text/javascript\"> alert(\"Not Authorize.\"); window.location = \"index.php\" </script>"; } } // Edit User Function function edit_user(){ include 'conn.php'; $id = $_GET['id']; $stmt = $conn->prepare("SELECT * FROM user WHERE user_id='$id' "); $stmt->execute(); while($row = $stmt->fetch()){ $user_id = $row['user_id']; $username = $row['username']; $password = $row['password']; $role = $row['role']; $status = $row['status']; echo " <input type='text' name='post_id' value='$user_id' hidden> <input type='text' name='username' placeholder='Username' autocomplete='off' minlength='4' autofocus required value='$username' readonly> <br><br> <select name='role'> <option value='$role'>$role</option> <option value='User'>User</option> <option value='Admin'>Admin</option> <option value='Dev'>Dev</option> </select>"; } } // Display All Questions in Select Option function questions(){ include 'conn.php'; $stmt = $conn->prepare("SELECT * FROM tbl_security_question"); $stmt->execute(); while($row = $stmt->fetch()){ $question = $row['security_question']; $id = $row['security_question_id']; echo "<option value='$id'>$question</option>"; } } //Update Security Question function secquestion(){ include 'session.php'; include 'conn.php'; $stmt = $conn->prepare("SELECT * FROM user WHERE username='$session_username' "); $stmt->execute(); while($row = $stmt->fetch()){ $stmt = $conn->prepare("SELECT * FROM tbl_security_question"); $stmt->execute(); while($row = $stmt->fetch()){ $question = $row['security_question']; $id = $row['security_question_id']; echo "<option value='$id'>$question</option>"; } } if(isset($_POST['security_questions'])){ $question = $_POST['questions']; $answer = $_POST['secanswer']; $stmt = $conn->prepare("UPDATE user SET security_question_id=:question, security_answer=:answer WHERE username='$session_username' "); $stmt->bindParam(':question', $question); $stmt->bindParam(':answer', $answer); $answer = dbtest($answer, PASSWORD_DEFAULT); $stmt->execute(); echo "<script type=\"text/javascript\"> alert(\"Updated!.\"); window.location = \"index.php\" </script>"; } } //if Username is correct if(isset($_POST['forgot'])){ $stmt = $conn->prepare("SELECT * FROM user WHERE username=:username"); $stmt->bindParam(':username',$username); $stmt->execute(); $row = $stmt->fetch(); if($row>0){ $id = $row['security_question_id']; $_SESSION['forgot-password']=$row['username']; echo "<script type=\"text/javascript\"> alert(\"Updated!.\"); window.location = \"forgot-Password-auth.php\" </script>"; } else{ $status = "Wrong Username"; } } function question_auth(){ global $conn; global $session_forgot; $stmt = $conn->prepare("SELECT tbl_security_question.security_question AS question FROM tbl_security_question JOIN user ON tbl_security_question.security_question_id=user.security_question_id WHERE user.username='$session_forgot' "); $stmt->execute(); while($row = $stmt->fetch()){ $question = $row['question']; echo $question; } } //forgot password auth success if(isset($_POST['forgot-password-auth'])){ $secanswer = $_POST['secanswer']; $stmt = $conn->prepare("SELECT security_answer FROM user WHERE username='$session_forgot' "); $row = $stmt->fetch(); if($row >0){ if(password_verify($password, $row['password'])){ header('location: retrieving.php'); } } } // Edit User Query if(isset($_POST['edit_user'])){ $id=$_POST['post_id']; $stmt = $conn->prepare("UPDATE user SET role=:role WHERE user_id='$id' "); $stmt->bindParam(':role', $role); $stmt->execute(); echo "<script type=\"text/javascript\"> alert(\"Updated!.\"); window.location = \"index.php\" </script>"; } // Admin Session Only function admin(){ include 'session.php'; if($session_role=='Admin' || $session_role=='Dev'){ } else { echo "<script type=\"text/javascript\"> alert(\"Authorized Only!.\"); window.location = \"index.php\" </script>"; } } //Delete Query if(isset($_GET['del'])){ $id = $_GET['del']; $stmt = $conn->prepare("UPDATE user SET status='delete' WHERE user_id='$id' AND user_id>=2 "); if($stmt->execute()){ echo "<script type=\"text/javascript\"> alert(\"Deletdasdased!.\"); window.location = \"index.php\" </script>"; } else { echo "<script type=\"text/javascript\"> alert(\"Not Deleted!.\"); window.location = \"index.php\" </script>"; } } ?>