userlist

<?php
require_once('authenticate.php');
include_once('includes/header.inc.php');
include_once('includes/navigation.inc.php');
//variable for email used in login
$email = $_SESSION['email'];
//selects profile in database that correlates with $email variable
$result = mysql_query("SELECT * FROM users WHERE email='$email'") or die(mysql_error());
$row = mysql_fetch_array($result);
//variable check for admin value in database
$admin = $row['admin'];
//if the user is an admin he will proceed
if ($admin == '1') {
$idQuery = "SELECT * FROM users ORDER BY id LIMIT 0, 20";
$id_result = mysql_query($idQuery, $dbhandle);
if (isset($_GET["page"])) { $page  = $_GET["page"]; } else { $page=1; };
$start_from = ($page-1) * 20;
$columnname = "";
			if ($_GET['columnname']) {
			$columnname = $_GET['columnname'];
			} else {
				$columnname = "ID";
			}
			$order = "";
			if ($_GET['order']) {
			$order = $_GET['order'];
			} else {
				$order = "";
			}
			if ($order == "") {
			$order = "ASC"; }
			elseif ($order == "ASC") {
			$order = "DESC";}
			elseif ($order == "DESC") {
			$order = "ASC";}
			if ($columnname == "")
			{$columnname = "id"; }
			$query = mysql_query("SELECT * FROM users ORDER BY $columnname $order LIMIT $start_from, 20");
			$sqlr = "SELECT COUNT(id) FROM users";
			$rs_result = mysql_query($sqlr,$dbhandle);
			$rowr = mysql_fetch_row($rs_result);
			$total_records = $rowr[0];
			$total_pages = ceil($total_records / 20);

            function sanitizez($data)	{
				$data=trim($data);
				$data=htmlspecialchars($data);
				$data=mysql_real_escape_string($data);
				return $data;
            }
			function HashPassword($input)	{
				//Credits: http://crackstation.net/hashing-security.html
				//This is secure hashing the consist of strong hash algorithm sha 256 and using highly random salt
				$salt = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));
				$hash = hash("sha256", $salt . $input);
				$final = $salt . $hash;
				return $final;
			}
?>
<h2>User List</h2>
<div id="userlist">
<div class="row title">
    <div class="column id no-border">
    	<a href="?columnname=id&order=asc"><h2 title="Arrange User ID in numerical order - This is active by default" alt="Arrange User ID in numerical order - This is active by default" class="tt-n">User ID</h2></a>
    </div>
    <div class="column email no-border">
    	<a href="?columnname=email&order=asc"><h2 title="Arrange list by Email Address in alphabetical order" alt="Arrange list by Email Address in alphabetical order" class="tt-n">Email Address</h2></a>
    </div>
    <div class="column loginattempt no-border">
    	<a href="?columnname=loginattempt&order=desc"><h2 title="Arrange list by the greatest number of Login Attempts to the least" alt="Arrange list by the greatest number of Login Attempts to the least" class="tt-n">Login Attempts</h2></a>
    </div>
    <div class="column admin no-border">
    	<a href="?columnname=admin&order=desc"><h2 title="Arrange list by those who have Admin privileges to those who don't" alt="Arrange list by those who have Admin privileges to those who don't" class="tt-n">Admin</h2></a>
    </div>
</div>
<?php while ($queryf = mysql_fetch_array($query)) { ?>
<div class="row">
    <div class="column id">
        <h5><?php echo $queryf['id']; ?></h5>
    </div>
    <div class="column email">
        <?php echo $queryf['email']; ?>
    </div>
    <div class="column loginattempt">
        <h5><?php echo $queryf['loginattempt']; ?></h5>
    </div>
    <div class="column admin">
        <?php
		$rowid = $queryf['id'];
		$emailr = $queryf['email'];
		if ($queryf['admin'] == '1') {
			if(!empty($_POST['submit-id'.$rowid.''])){
				$adminYes = "UPDATE users SET admin = '0' where email = '$emailr'";
				mysql_query($adminYes);
		}
		echo '<form action="" method="post">
		<input name="submit-id'.$rowid.'" type="submit" class="btnLogin tt-ul" value="Enabled" title="Clicking will remove admin privileges from: '; echo $emailr; echo '" />
		</form>';
		} else {
				echo '<form action="" method="post" id="confirm">';
					if(!empty($_POST['submit-id'.$rowid.''])){
						$adminNo = "UPDATE users SET admin = '1' where email = '$emailr'";
						mysql_query($adminNo);
					}
					echo '<input name="submit-id'.$rowid.'" type="submit" class="btnLogin tt-ul" value="Disabled" title="Clicking will grant admin privileges to: ';echo $emailr;echo '" />
					</form>';
				}
		?>
    </div>
    <div class="column editprofile"><a href="" title="Edit profile: <?php echo $emailr ?>" alt="Edit Profile" class="edit-profile tt-ul">Edit Profile</a></div>
    <div class="column deleteprofile">
    	<form onsubmit="return false;" action="" method="post">
			<input name="submit" type="submit" class="btnLogin tt-ul" value="Delete" title="Clicking will delete profile: <?php echo $emailr; ?>" />
		</form>
    </div>
    </div>
    <div class="row hide-id">
    	<h2>Profile: <?php echo $emailr ?></h2>
        <ul id="settings">
        <a href="" style="width:150px"><li title="Change this user's password" alt="Change Password" class="tt-w">Change Password</li></a>
        <?php
		if(isset($_POST['p-'.$rowid.''])) {
		$newpassword = sanitizez($_REQUEST['np-'.$rowid.'']);	{
            $hashedpassword = HashPassword($newpassword);
		}
		$sql = "UPDATE users SET password = '$hashedpassword' where email = '$emailr'";
		mysql_query($sql);
		}
		?>
        <div class="hide-form">
			<form class="box login" action="userlist.php" method="post" id="p-<?php echo $rowid ?>">
			<fieldset class="boxBody">
			<label lang="en" for="newpassword">New Password:</label>
            <input type="password" name="newpassword" id="newpassword" tabindex="1" title="Must be alphanumeric and greater than 8 characters" class="tt-w" />
            <label lang="en" for="cpassword">Confirm Password:</label>
            <input type="password" name="cpassword" id="cpassword" tabindex="2" title="Re-type password" class="tt-w" />
			</fieldset>
			<footer>
            <input lang="en" name="np-<?php echo $rowid ?>" type="submit" class="btnLogin" value="Change Password" tabindex="3" />
			</footer>
            </form>
        </div>
        <a href="" style="width:170px"><li title="Update this user's email address" alt="Update Email Address" class="tt-w">Update Email Address</li></a>
        <div class="hide-form">
				<form class="box login" action="?go=updated" method="post">
				<fieldset class="boxBody">
				<label lang="en" for="newpassword">New Email Address:</label>
                <input type="text" name="newpassword" id="newpassword" tabindex="1" title="Using [email protected] format" class="tt-w" />
                <label lang="en" for="cpassword">Confirm Email Address:</label>
                <input type="text" name="cpassword" id="cpassword" tabindex="2" title="Re-type email address" class="tt-w" />
				</fieldset>
				<footer>
                <input lang="en" name="submit" type="submit" class="btnLogin" value="Update Email Address" tabindex="3" />
				</footer>
                </form>
        </div>
        <?php
        if ($queryf['loginattempt'] <= '5') {
			if(!empty($_POST['lattempt-id'.$rowid.''])){
				$banUser = "UPDATE users SET loginattempt = '9' where email = '$emailr'";
				mysql_query($banUser);
		}
		echo '<form action="" method="post">
			  <input name="lattempt-id'.$rowid.'" type="submit" class="tt-w" value="Ban User" title="Click to ban this user" />
			  </form>
        	  <div class="hide-form">';
		} else {
			if ($queryf['loginattempt'] >= '6') {
				if(!empty($_POST['lattempt-id'.$rowid.''])){
					$unbanUser = "UPDATE users SET loginattempt = '0' where email = '$emailr'";
					mysql_query($unbanUser);
				}
				echo '<form action="" method="post" id="confirm">
				<input name="lattempt-id'.$rowid.'" type="submit" class="tt-w" value="Unban User" title="Click to unban user" />
				</form>';
			}
		}
		?>
        </ul>
    </div>
<?php
}
	echo '<div id="pages"><p style="float:left;margin-right: 5px;">Pages: </p>';
	for ($i=1; $i<=$total_pages; $i++) {
    echo "<a href='?page=".$i."'><div title='Go to page ".$i."' class='tt-ul pagenumbers'>".$i."</div></a>";
	};
echo '</div>';
echo '<p style="font-style:italic;float:left;margin: 10px 0 0 -30px">The database has a total of '.$total_records.' profiles.</p>';
$row = mysql_fetch_assoc($id_result);
?>
</div>
<?php
} else {
echo '<h2>Restricted Access</h2><p align="center">Only Administrators can access this page. Please log in to your account to proceed.</p>';
}
include_once('includes/footer.inc.php');
?>