authenticate.php

<?php
// MySQL Credentials
$mysqlhost = "localhost";
$mysqldb = "xenforo";
$mysqluser = "authenticator";
$mysqlpass = "&Z71EMkC%tby";

// Opens the connection to the db
$db = MySQLI_Connect($mysqlhost, $mysqluser, $mysqlpass, $mysqldb);

$code = $_GET["code"];
$user = $_GET["user"];
$query = "SELECT user FROM tshock_auth WHERE code = '" . $db->real_escape_string($code) . "';";
$result = $db->query($query);

/* Return Codes
    0 - query failure
    404 - invalid code
    200 - successful binding
*/
if (!result)
    printf('0');
else
{
    $data = $result->fetch_all($resulttype = MYSQLI_ASSOC);
    if (!$data[0])
        printf("404");
    else
    {
        // Authentication was successful, remove entry and set tshockID
        $xfuser_id = $data[0]["user"];
        $query = "UPDATE xf_user SET tshock_id = " . $user . " WHERE user_id = " . $xfuser_id . ";";
        $result = $db->query($query);
        if ($result)
        {
            $query = "DELETE FROM tshock_auth WHERE user = " . $xfuser_id . ";";
            $db->query($query);
            printf("200" . "," . $xfuser_id);
        }
        else
            printf("0");
    }
}
?>