Untitled

<html>
<body>
<?php

$host = "5.6.7.8";
$user = "test";
$password = "testpass";
$database = "testdb";

$connection = mysql_connect($host,$user,$password)
        or die("Could not connect: ".mysql_error());

mysql_select_db($database,$connection)
        or die("Error in selecting the database:".mysql_error());

$var1 = $_GET["username"];
$sql= sprintf("Select id,password FROM vms WHERE username='%s'", mysql_real_escape_string($var1));

$sql_result=mysql_query($sql,$connection)
        or exit("Sql Error".mysql_error());

$sql_num=mysql_num_rows($sql_result);

while($sql_row=mysql_fetch_array($sql_result))
{
        $id=$sql_row["id"];
        $password=$sql_row["password"];

        $findport=rand(25000, 65534);
        echo "<h4> Matched username to VMID ".$id."</h4>";
        echo "<h5> Port: $findport </h5>";
        $cmd="/usr/bin/sudo -b /bin/nc -l -p $findport -c '/usr/sbin/qm vncproxy $id $password'";
        echo $cmd;
        exec ($cmd);
}
?>

</body>
</html>