<?
/**
 * Process.php
 */

include("database.php");
 /**
 * POST variables from form - need to be sanitized.
 */

if(isset($_POST["sublogin"] )) {
$subuser = $_POST["username"];
$subpassword = $_POST["password"];
$sublogin = $_POST["sublogin"];
}

if(isset($_POST["subregister"] )) {

$subuser = $_POST["username"];
$subfirst = $_POST["firstname"];
$subsurname = $_POST["surname"];
$subpassword = $_POST["password"];
$subregister = $_POST["subregister"];

}

/**
* Check username function.
*/

function usernameTaken($username){
    $q = "SELECT username FROM ".TBL_USERS." WHERE username = '$username'";
    $result = mysql_query($q);
    return (mysql_num_rows($result) > 0);
    }


 /**
 * Check password function.
 */

   function confirmUserPass($username, $password){

    /* Verify that user is in database */
      $q = "SELECT password FROM ".TBL_USERS." WHERE username = '$username'";
      $result = mysql_query($q);
      if(!$result || (mysql_numrows($result) < 1)){
         return 1; //Indicates username failure
      }

      /* Retrieve password from result */
      $dbarray = mysql_fetch_array($result);


      /* Validate that password is correct */
      if($password == $dbarray['password']){
         return 0; //Success! Username and password confirmed
      }
      else{
         return 2; //Indicates password failure
      }
   }

/**
 * REGISTER - Username not in use
 */
  if (isset ($subregister)) {
if (usernameTaken($subuser) == 0 ) {

    $q = mysql_query ("INSERT INTO information (username, firstname, surname, password) VALUES ('$subuser', '$subfirst', '$subsurname', '$subpassword')");  echo mysql_error();
    $success = 1;
    if ($success == 1) { echo "User ".$subuser." Added"; }
    }

/**
 * REGISTER - Username in use
 */
else if (usernameTaken($subuser)) {
    echo "User ".$subuser." already exists, choose another username";
    header('Refresh:3; URL= informationform.php');
        }
        }
 /**
 * LOGIN - this is not secure
 */

 if ($sublogin == 1) {
      $result = confirmUserPass($subuser, $subpassword);
    //echo $result;

      /* Check error codes */
      if($result == 1){
    // username not found
    echo "Username Not Found";
    header('Refresh:3; URL= login.html');
    }
      else if($result == 2){
    // password incorrect
    echo "Password Incorrect";
    header('Refresh:3; URL= login.html');
    }
      else if($result == 0){
    // password and user correct, forward to members page
    echo "Logged In";
    header('Refresh:3; URL= display_users.php');
      }
 }

?>


<a href="display_users.php">Show Users</a><br / >
<a href="register.php">Add a new user</a>