connect_error)
{
die("Connect Error (" . $mysqli->connect_errno . ")"
. $mysqli->connect_error);
}
$func = $_POST['function'];
if($func!="login"&&$func!="sign")
{
$cookie = $_COOKIE["name"];
$counter = new Counter(5);
$observer = new CountListener($cookie);
$counter->Attach($observer);
}
switch($func)
{
case "login":
$enteredName = $_POST['username'];
$enteredPwd = $_POST['password'];
if($enteredName=='')
{
echo "";
}
else if($enteredPwd=='')
{
echo "";
}
$name = PreventSqlInjection($mysqli, $_POST["username"]);
$pwd = PreventSqlInjection($mysqli, $_POST["password"]);
$counter = new Counter(5);
$observer = new CountListener($enteredName);
$counter->Attach($observer);
$counter->Login($name, $pwd, $mysqli);
break;
case "sign":
$enteredName = $_POST["username"];
$enteredPwd = $_POST["password"];
$enteredInfo = $_POST["information"];
if($enteredName=='')
{
echo "";
}
else if($enteredPwd=='')
{
echo "";
}
$name = PreventSqlInjection($mysqli, $_POST["username"]);
$pwd = PreventSqlInjection($mysqli, $_POST["password"]);
$info = PreventSqlInjection($mysqli, $_POST["information"]);
$counter = new Counter(5);
$observer = new CountListener($name);
$counter->Attach($observer);
if($name=='user'||$name=='administrator')
{
echo "";
}else
{
$counter->Sign($name, $pwd, $info, $mysqli);
$counter->Login($name, $pwd, $mysqli);
}
break;
case "search":
$search = PreventSqlInjection($mysqli, $_POST['search']);
if($search=='user'||$search=='administrator')
{
$counter->SearchID($cookie, $search, $mysqli);
}else
{
$counter->Search($cookie, $search, $mysqli);
}
break;
case "create":
$name = PreventSqlInjection($mysqli, $_POST["username"]);
$pwd = PreventSqlInjection($mysqli, $_POST["password"]);
$info = PreventSqlInjection($mysqli, $_POST["information"]);
$id = PreventSqlInjection($mysqli, $_POST["id"]);
if($name=='user'||$name=='administrator')
{
echo "";
}else
{
$counter->Create($name, $pwd, $info, $id, "create a user: {$name}", 1, $mysqli);
}
break;
case "delete":
$key = PreventSqlInjection($mysqli, $_POST['username']);
$counter->Delete($key, $mysqli);
break;
case "update":
$name = PreventSqlInjection($mysqli, $_POST["username"]);
$pwd = PreventSqlInjection($mysqli, $_POST["password"]);
$info = PreventSqlInjection($mysqli, $_POST["information"]);
$id = PreventSqlInjection($mysqli, $_POST["id"]);
$new = PreventSqlInjection($mysqli, $_POST["newname"]);
if($new=='user'||$new=='administrator')
{
echo "";
}else
{
$counter->Update($cookie, $name, $pwd, $info, $id, $new, $mysqli);
}
break;
case "profile":
$pwd = PreventSqlInjection($mysqli, $_POST["password"]);
$info = PreventSqlInjection($mysqli, $_POST["information"]);
$counter->Profile($cookie, $pwd, $info, $mysqli);
break;
case "logout":
$counter->Logout($mysqli);
break;
case "searchG":
$search = PreventSqlInjection($mysqli, $_POST['searchG']);
$counter->SearchG($search, $mysqli);
break;
case "searchS":
$search = PreventSqlInjection($mysqli, $_POST['searchS']);
$counter->SearchS($cookie, $search, $mysqli);
break;
case "createG":
$name = PreventSqlInjection($mysqli, $_POST["name"]);
$math = PreventSqlInjection($mysqli, $_POST["math"]);
$art = PreventSqlInjection($mysqli, $_POST["art"]);
$science = PreventSqlInjection($mysqli, $_POST["science"]);
$feedback = PreventSqlInjection($mysqli, $_POST["feedback"]);
$counter->CreateG($name, $math, $art, $science, $feedback, "submit a grade for {$name}", $mysqli);
break;
case "deleteG":
$key = PreventSqlInjection($mysqli, $_POST['name']);
$counter->DeleteG($key, $mysqli);
break;
case "updateG":
$name = PreventSqlInjection($mysqli, $_POST["name"]);
$math = PreventSqlInjection($mysqli, $_POST["math"]);
$art = PreventSqlInjection($mysqli, $_POST["art"]);
$science = PreventSqlInjection($mysqli, $_POST["science"]);
$feedback = PreventSqlInjection($mysqli, $_POST["feedback"]);
$counter->UpdateG($name, $math, $art, $science, $feedback, $mysqli);
break;
}
// Prevent hacker typing something nasty into a Form
// and performing an SQL injection attack.
function PreventSqlInjection($mysqli, $text)
{
// Magic Quotes can be turned on in php.ini to protect
// beginner PHP coders from SQL injection attacks.
// e.g. "It's good" after applying magic quotes
// becomes "It\'s good".
// Not all GET and POST data needs to be escaped,
// so experienced coders turn this off.
// When writing to MySQL, remove
if (get_magic_quotes_gpc()) // Is magic quotes on?
{
$text = stripslashes($text); // Remove the slashes added
}
// If using MySQL, escape special characters
return $mysqli->real_escape_string($text);
}
$closed = $mysqli->close();
if($closed == false)
{
die("Connection closed failed " . mysqli_error());
}
?>