ANTICHAT — форум по информационной безопасности, OSINT и технологиям

<?
require 'config.php';
require 'pages/functions.php';
require 'pages/query.php';

if ($_POST['action']=='login')
{
mssql_connect ($CONFIG['mssqlip'], $CONFIG['dbuser'], $CONFIG['dbpass']);
mssql_select_db($CONFIG['mssqllin2db']);
$postusername = isset($_POST['username'])?$_POST['username']:null;
$postpassword = isset($_POST['password'])?$_POST['password']:null;
$new_random = isset($_POST['random'])?$_POST['random']:null;
session_start();
$new_string=$_SESSION["new_string"];
$new_string=antiinjection($new_string);
$postusername = antiinjection($postusername);
$postpassword = antiinjection($postpassword);
$result = mssql_query(sprintf(SELECT_USER_PASS,$postusername ));
$num_user_pass=mssql_num_rows($result);
$user_pass=mssql_fetch_array($result);
$password = '0x'.bin2hex($user_pass['password']);
list ($Id) = mssql_fetch_row(mssql_query("INSERT INTO ".$CONFIG['mssqlcp_log'].".dbo.acc_auth (account,password,random,date,remote_addr,status) VALUES ('".$postusername."','".$postpassword."','".$new_s tring."',GETDATE(),'".$_SERVER['REMOTE_ADDR']."',0); SELECT @@IDENTITY as insertId;"));
if ($new_string != $new_random)
{
echo '<script> alert("Неверный код."); </script>';
}
else
{
if (@password_encrypt($postpassword)==$password && $num_user_pass==1)
{
@setcookie("login", $user_pass['account'], time()+1800);
@setcookie("site_user", $user_pass['account'], time()+1800);
@setcookie("pass", md5($password), time()+1800);
mssql_query("UPDATE ".$CONFIG['mssqlcp_log'].".dbo.acc_auth SET status=1 WHERE id='".$Id."'");
}
else
{
echo '<script> alert("Неверный логин или пароль."); </script>';
}
}
quickrefresh('index.php');
}
else
{
quickrefresh('index.php');
}
?>