backend/server.php at master · someshrf/backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
<!DOCTYPE html>
<html>
 <head>
   <link rel="stylesheet" type="text/css" href="style.css">
 </head>
<body>

<?php
// Enter your Host, username, password, database below.
session_start();
$username="";

$errors=array();

$db = mysqli_connect('localhost','root','','registration');
// Check connection

//registration

   if(isset($_POST['register'])){

  	$username = mysqli_real_escape_string($db, $_POST['username']);

    $password_1 = mysqli_real_escape_string($db, $_POST['password_1']);
    $password_2 = mysqli_real_escape_string($db, $_POST['password_2']);

    $password = md5($password_1);

    if(empty($username)) {
    	array_push($errors,"username is required");
    }
    if(empty($password_1)) {
    	array_push($errors,"Password is required");
    }
    if($password_1 != $password_2) {
    	array_push($errors,"passwords do not match");
    }

   if(empty($errors)) {
  	$sql = "INSERT INTO users (username,password,type) VALUES ('$username','$password','student')";
  	mysqli_query($db,$sql);
    ?>
    <p style="color:green;">Registered Successfully</p>
  <?php
    }
  }

//add notes
if(isset($_POST['addnote'])) {

  $note1 = mysqli_real_escape_string($db, $_POST['note']);

   if($note1) {
    $sql = "INSERT INTO notes (texts) VALUES ('$note1')";
    mysqli_query($db,$sql);
    }
}

//delete notes
if(isset($_POST['delnote'])) {

  $note1 = mysqli_real_escape_string($db, $_POST['nos']);

   if($note1) {
    $sql = "DELETE FROM notes WHERE id='$note1'";
    mysqli_query($db,$sql);
    }
}

//make admin
if(isset($_POST['useradm'])) {

  $note1 = mysqli_real_escape_string($db, $_POST['useradmin']);

   if($note1) {
    $sql = "UPDATE users set type ='prof' WHERE id='$note1'";
    mysqli_query($db,$sql);
    }
}

//login
if(isset($_POST['login'])) {
    $username = mysqli_real_escape_string($db, $_POST['username']);
    $password = mysqli_real_escape_string($db, $_POST['password']);

   if(empty($username)) {
      array_push($errors,"username is required");
    }

   if(empty($username)) {
      array_push($errors,"username is required");
    }

  if (count($errors)==0) {
    $password=md5($password);
    $query="SELECT * FROM users WHERE username='$username' AND password='$password'";
      $result=mysqli_query($db,$query);
      $row = $result->fetch_assoc();
      //echo $row["id"];
     if(mysqli_num_rows($result)==1){
      $_SESSION['username']=$username;
      $_SESSION['success']="You are logged in";
      header('location:index1.php');
      $_SESSION['post']= $row["type"];
    }else{
      array_push($errors,"wrong combination");
    }

  }

}


//logout
 if(isset($_GET['logout'])) {
    session_destroy();
    unset($_SESSION['username']);
    header('location:login.php');

 }

?>

 </body>
</html>