milw0rm

<?php



                            if (!($user -> LoggedIn()))

                            {

                                if (isset($_POST['loginBtn']))

                                {

                                    $username = $_POST['username'];

                                    $password = $_POST['password'];

                                    $errors = array();

                                    if (!ctype_alnum($username) || strlen($username) < 4 || strlen($username) > 15)

                                    {

                                        $errors[] = 'Username must be 4-15 characters in length';

                                    }



                                    if (empty($username) || empty($password))

                                    {

                                        $errors[] = 'Please fill in all fields';

                                    }



                                    if (empty($errors))

                                    {

                                        $SQLCheckLogin = $odb -> prepare("SELECT COUNT(*) FROM `users` WHERE `username` = :username");

                                        $SQLCheckLogin -> execute(array(':username' => $username));

                                        $countLogin = $SQLCheckLogin -> fetchColumn(0);

                                        if ($countLogin == 1)

                                        {



                                        	$gethashSQL = $odb -> prepare("SELECT `password` FROM `users` WHERE `username` = :username");

                                        	$gethashSQL -> execute(array(":username" => $username));

                                        	$hash = $gethashSQL -> fetch();



                                        	if (hash_equals($hash['password'], crypt($password, $hash['password']))) {



	                                            $SQLGetInfo = $odb -> prepare("SELECT `username`, `ID` FROM `users` WHERE `username` = :username");

	                                            $SQLGetInfo -> execute(array(':username' => $username));

	                                            $userInfo = $SQLGetInfo -> fetch(PDO::FETCH_ASSOC);

	                                            if ($userInfo['status'] == 0)

	                                            {
                                                    $username = $userInfo['username'];
	                                                $_SESSION['username'] = $userInfo['username'];

	                                                $_SESSION['ID'] = $userInfo['ID'];



	                                                echo '<div class="alert alert-success alert-dismissable fade in"><p><center>Login Successful! Redirecting...</center></p></div><meta http-equiv="refresh" content="3;url=dashboard.php">';

	                                            }

	                                            else

	                                            {

	                                                echo '<div class="alert alert-danger alert-dismissable fade in"><p><center>You have been banned!</center></p></div>';

	                                            }







	                                        } else {

	                                        	echo '<div class="alert alert-danger alert-dismissable fade in"><p><center>Login Failed! Please try again.</center></p></div>';

	                                        }



                                        }

                                        else

                                        {

                                            echo '<div class="alert alert-danger alert-dismissable fade in"><p><center>Login Failed! Please try again.</center></p></div>';

                                        }

                                    }

                                    else

                                    {

                                        echo '<center><div class="alert alert-danger alert-dismissable fade in"><p><strong></strong>';

                                        foreach($errors as $error)

                                        {

                                            echo ''.$error.'';

                                        }

                                        echo '</div></center>';

                                    }

                                }

                            }

                            else

                            {

                                header('location: dashboard.php');

                            }

                            ?>