userlist

<?php
require_once('authenticate.php');
include_once('includes/header.inc.php');
include_once('includes/navigation.inc.php');
//variable for email used in login
$email = $_SESSION['email'];
//selects profile in database that correlates with $email variable
$result = mysql_query("SELECT * FROM users WHERE email='$email'") or die(mysql_error());
$row = mysql_fetch_array($result);
//variable check for admin value in database
$admin = $row['admin'];
//if the user is an admin he will proceed
if ($admin == '1') {
$idQuery = "SELECT * FROM users ORDER BY id LIMIT 0, 20";
$id_result = mysql_query($idQuery, $dbhandle);
if (isset($_GET["page"])) { $page  = $_GET["page"]; } else { $page=1; };
$start_from = ($page-1) * 20;
$columnname = "";
            if ($_GET['columnname']) {
            $columnname = $_GET['columnname'];
            } else {
                $columnname = "ID";
            }
            $order = "";
            if ($_GET['order']) {
            $order = $_GET['order'];
            } else {
                $order = "";
            }
            if ($order == "") {
            $order = "ASC"; }
            elseif ($order == "ASC") {
            $order = "DESC";}
            elseif ($order == "DESC") {
            $order = "ASC";}
            if ($columnname == "")
            {$columnname = "id"; }
            $query = mysql_query("SELECT * FROM users ORDER BY $columnname $order LIMIT $start_from, 20");
            $sqlr = "SELECT COUNT(id) FROM users";
            $rs_result = mysql_query($sqlr,$dbhandle);
            $rowr = mysql_fetch_row($rs_result);
            $total_records = $rowr[0];
            $total_pages = ceil($total_records / 20);

            function sanitizez($data)   {
            $data=trim($data);
            $data=htmlspecialchars($data);
            $data=mysql_real_escape_string($data);
            return $data;
            }

                function HashPassword($input)   {
                //Credits: http://crackstation.net/hashing-security.html
                //This is secure hashing the consist of strong hash algorithm sha 256 and using highly random salt
                    $salt = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));
                    $hash = hash("sha256", $salt . $input);
                    $final = $salt . $hash;
                    return $final;
                }
?>
<h2>User List</h2>
<div id="userlist">
<div class="row title">
    <div class="column id no-border">
        <a href="?columnname=id&order=asc"><h2 title="Arrange User ID in numerical order - This is active by default" alt="Arrange User ID in numerical order - This is active by default" class="tt-n">User ID</h2></a>
    </div>
    <div class="column email no-border">
        <a href="?columnname=email&order=asc"><h2 title="Arrange list by Email Address in alphabetical order" alt="Arrange list by Email Address in alphabetical order" class="tt-n">Email Address</h2></a>
    </div>
    <div class="column loginattempt no-border">
        <a href="?columnname=loginattempt&order=desc"><h2 title="Arrange list by the greatest number of Login Attempts to the least" alt="Arrange list by the greatest number of Login Attempts to the least" class="tt-n">Login Attempts</h2></a>
    </div>
    <div class="column admin no-border">
        <a href="?columnname=admin&order=desc"><h2 title="Arrange list by those who have Admin privileges to those who don't" alt="Arrange list by those who have Admin privileges to those who don't" class="tt-n">Admin</h2></a>
    </div>
</div>
<?php while ($queryf = mysql_fetch_array($query)) { ?>
<div class="row">
    <div class="column id">
        <h5><?php echo $queryf['id']; ?></h5>
    </div>
    <div class="column email">
        <?php echo $queryf['email']; ?>
    </div>
    <div class="column loginattempt">
        <h5><?php echo $queryf['loginattempt']; ?></h5>
    </div>
    <div class="column admin">
        <?php
        $rowid = $queryf['id'];
        $emailr = $queryf['email'];
        if ($queryf['admin'] == '1') {
            if(!empty($_POST['submit-id'.$rowid.''])){
                $adminYes = "UPDATE users SET admin = '0' where email = '$emailr'";
                mysql_query($adminYes);
        }
        echo '<form action="" method="post">
        <input name="submit-id'.$rowid.'" type="submit" class="btnLogin tt-ul" value="Enabled" title="Clicking will remove admin privileges from: '; echo $emailr; echo '" />
        </form>';
        } else {
                echo '<form action="" method="post" id="confirm">';
                    if(!empty($_POST['submit-id'.$rowid.''])){
                        $adminNo = "UPDATE users SET admin = '1' where email = '$emailr'";
                        mysql_query($adminNo);
                    }
                    echo '<input name="submit-id'.$rowid.'" type="submit" class="btnLogin tt-ul" value="Disabled" title="Clicking will grant admin privileges to: ';echo $emailr;echo '" />
                    </form>';
                }
        ?>
    </div>
    <div class="column editprofile"><a href="" title="Edit profile: <?php echo $emailr ?>" alt="Edit Profile" class="edit-profile tt-ul">Edit Profile</a></div>
    <div class="column deleteprofile">
        <form onsubmit="return false;" action="" method="post">
            <input name="submit" type="submit" class="btnLogin tt-ul" value="Delete" title="Clicking will delete profile: <?php echo $emailr; ?>" />
        </form>
    </div>
    </div>
    <div class="row hide-id">
        <h2>Profile: <?php echo $emailr ?></h2>
        <ul id="settings">
        <a href="" style="width:150px"><li title="Change this user's password" alt="Change Password" class="tt-w">Change Password</li></a>
        <div class="hide-form">
        <?php
        $newpassword = sanitizez($_REQUEST['np-'.$rowid.'']);   {
            $hashedpassword = HashPassword($newpassword);
        }
        $sql = "UPDATE users SET password = '$hashedpassword' where email = '$emailr'";
        mysql_query($sql);
        ?>
            <form class="box login" action="index.php" method="post">
            <fieldset class="boxBody">
            <label lang="en" for="newpassword">New Password:</label>
            <input type="password" name="newpassword" id="newpassword" tabindex="1" title="Must be alphanumeric and greater than 8 characters" class="tt-w" />
            <label lang="en" for="cpassword">Confirm Password:</label>
            <input type="password" name="cpassword" id="cpassword" tabindex="2" title="Re-type password" class="tt-w" />
            </fieldset>
            <footer>
            <input lang="en" name="np-<?php echo $rowid ?>" type="submit" class="btnLogin" value="Change Password" tabindex="3" />
            </footer>
            </form>
        </div>
        <a href="" style="width:170px"><li title="Update this user's email address" alt="Update Email Address" class="tt-w">Update Email Address</li></a>
        <div class="hide-form">
                <form class="box login" action="?go=updated" method="post">
                <fieldset class="boxBody">
                <label lang="en" for="newpassword">New Email Address:</label>
                <input type="text" name="newpassword" id="newpassword" tabindex="1" title="Using [email protected] format" class="tt-w" />
                <label lang="en" for="cpassword">Confirm Email Address:</label>
                <input type="text" name="cpassword" id="cpassword" tabindex="2" title="Re-type email address" class="tt-w" />
                </fieldset>
                <footer>
                <input lang="en" name="submit" type="submit" class="btnLogin" value="Update Email Address" tabindex="3" />
                </footer>
                </form>
        </div>
        <?php
        if ($queryf['loginattempt'] <= '5') {
            if(!empty($_POST['lattempt-id'.$rowid.''])){
                $banUser = "UPDATE users SET loginattempt = '9' where email = '$emailr'";
                mysql_query($banUser);
        }
        echo '<form action="" method="post">
              <input name="lattempt-id'.$rowid.'" type="submit" class="tt-w" value="Ban User" title="Click to ban this user" />
              </form>
              <div class="hide-form">';
        } else {
            if ($queryf['loginattempt'] >= '6') {
                if(!empty($_POST['lattempt-id'.$rowid.''])){
                    $unbanUser = "UPDATE users SET loginattempt = '0' where email = '$emailr'";
                    mysql_query($unbanUser);
                }
                echo '<form action="" method="post" id="confirm">
                <input name="lattempt-id'.$rowid.'" type="submit" class="tt-w" value="Unban User" title="Click to unban user" />
                </form>';
            }
        }
        ?>
        </ul>
    </div>
<?php
}
    echo '<div id="pages"><p style="float:left;margin-right: 5px;">Pages: </p>';
    for ($i=1; $i<=$total_pages; $i++) {
    echo "<a href='?page=".$i."'><div title='Go to page ".$i."' class='tt-ul pagenumbers'>".$i."</div></a>";
    };
echo '</div>';
echo '<p style="font-style:italic;float:left;margin: 10px 0 0 -30px">The database has a total of '.$total_records.' profiles.</p>';
$row = mysql_fetch_assoc($id_result);
?>
</div>
<?php
} else {
echo '<h2>Restricted Access</h2><p align="center">Only Administrators can access this page. Please log in to your account to proceed.</p>';
}
include_once('includes/footer.inc.php');
?>