connect_error > 0) {
die('Could not connect: ' . $con->connect_error);
exit();
}
// use prepared statements. anti-sql injection
$sqlcmd = "SELECT CAST(LoginUserID as CHAR) as LoginUserID, LoginName, AccessLevel
from LoginUsers
WHERE Username = ? and UserPassword = ?";
$sql = $con->prepare($sqlcmd);
$sql->bind_param("ss", $Username, $UserPassword);
$sql->execute();
$sql->bind_result($LoginUserID, $LoginName, $AccessLevel);
$sql->store_result();
$sql->fetch();
// check if we have only 1 record
if ($sql->affected_rows == 0)
$errormsg = "Username/Password incorrect";
else {
// check if we have > 1 record
if ($sql->affected_rows > 1)
$errormsg = "Error: 0x123fe1abc has occurred. Contact Administrator";
else {
// if we get here its a good login
// check the access level 0 - is the user, 2 account is locked
if ($AccessLevel == 2)
$errormsg = "Unable to login - Account is locked";
else {
// keep track of key data - it is used throughout the webapp
$_SESSION['LoginName'] = $LoginName;
$_SESSION['AccessLevel'] = $AccessLevel;
$_SESSION['LoggedIn'] = 1;
// we have a login update the LoginUsers table to when they logged in
$sqlcmd = "UPDATE LoginUsers set LastLoggedIn = NOW() WHERE LoginUserID = ?";
$sql = $con->prepare($sqlcmd);
$sql->bind_param("i", $LoginUserID);
$sql->execute();
// redirect to the dashboard
header('Location: http://localhost/PannotinaCoDB/dashboard/index.php');
exit();
}
}
}
}
?>
Sign In to Pannotina Co Database