function CheckLogin($connection, $level)
{
// Check if all session variables are set
sec_session_start();
// specifically check our username and hashed password
if (isset($_SESSION['username'], $_SESSION['secondpw'])) {
$username = $_SESSION['username'];
$secondpw = $_SESSION['secondpw'];
$username = $connection->escape_string($username);
//$secondpw = $connection->escape_string($secondpw);
// Get the user-agent string of the user.
//$user_browser = $_SERVER['HTTP_USER_AGENT'];
$sql = "SELECT HashPassword,Salt from Users WHERE UserName = '******' AND Confirmed = '1' AND Level >= '" . $level . "' AND idUsers > 0;";
// parallel assignment short cut
list($result, $valid) = DoQuery($sql, $connection);
// output only if we have anything
if ($result && $valid) {
$row = mysqli_fetch_array($result);
$password = $row['HashPassword'];
$salt = $row['Salt'];
// don't share the hashed pw either
$options = ['cost' => 11, 'salt' => $salt];
$newhash = password_hash($password, PASSWORD_BCRYPT, $options);
// check stored hash against the regenerated value
if ($secondpw == $newhash) {
return true;
} else {
return false;
}
} else {
return false;
}
} else {
return false;
}
}
function getPass($username)
{
global $table_prefix;
$q = DoQuery("SELECT user_password FROM {$table_prefix}users WHERE username='******'");
$pass = Do_Fetch_Row($q);
return $pass[0];
}
function getPass($username)
{
global $SERVER;
$q = DoQuery("SELECT password FROM {$SERVER['TBL_PREFIX']}users WHERE username='******'");
$pass = Do_Fetch_Row($q);
return $pass[0];
}
function getPass($username)
{
global $INFO, $DATABASE, $_COOKIE, $SERVER;
mysql_close();
mysql_connect($INFO['sql_host'], $INFO['sql_user'], $INFO['sql_pass']);
mysql_select_db($INFO['sql_database']);
$q = DoQuery("SELECT password FROM {$INFO[sql_tbl_prefix]}members WHERE name='{$username}'");
echo mysql_error();
$pass = Do_Fetch_Row($q);
mysql_close();
DoConnect($DATABASE['HOST'], $DATABASE['USER'], $DATABASE['PASS']);
DoSelectDb($DATABASE['DATABASE']);
$q = DoQuery("SELECT * FROM {$SERVER['TBL_PREFIX']}users WHERE username='******'");
$row = Do_Fetch_Row($q);
if ($row[0] == "" && $_COOKIE['X2CHATP'] == $pass[0]) {
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}users VALUES('0','{$username}','','','1','','','','','','','','','14000,1000,1,1,0,3,1,0,0,1')");
}
return $pass[0];
}
function getPass($username)
{
global $nukepre, $nuke, $DATABASE, $SERVER, $_COOKIE;
mysql_close();
mysql_connect($nuke['DBHOST'], $nuke['UNAME'], $nuke['PWORD']);
mysql_select_db($nuke['DBNAME']);
$q = DoQuery("SELECT user_password FROM {$nukepre}users WHERE username='******'");
echo mysql_error();
$pass = Do_Fetch_Row($q);
mysql_close();
DoConnect($DATABASE['HOST'], $DATABASE['USER'], $DATABASE['PASS']);
DoSelectDb($DATABASE['DATABASE']);
$q = DoQuery("SELECT * FROM {$SERVER['TBL_PREFIX']}users WHERE username='******'");
$row = Do_Fetch_Row($q);
if ($row[0] == "" && $_COOKIE['X2CHATP'] == $pass[0]) {
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}users VALUES('0','{$username}','','','1','','','','','','','','','14000,1000,1,1,0,3,1,0,0,1')");
}
return $pass[0];
}
function getPass($username)
{
global $DATABASE, $_COOKIE, $SERVER, $xmb_host, $xmb_user, $xmb_password, $xmb_db, $xmb_prefix;
mysql_close();
@DoConnect("{$xmb_host}", "{$xmb_user}", "{$xmb_password}");
@DoSelectDb("{$xmb_db}");
$q = DoQuery("SELECT password FROM {$xmb_prefix}members WHERE username='******'");
echo mysql_error();
$pass = Do_Fetch_Row($q);
mysql_close();
DoConnect($DATABASE['HOST'], $DATABASE['USER'], $DATABASE['PASS']);
DoSelectDb($DATABASE['DATABASE']);
$q = DoQuery("SELECT * FROM {$SERVER['TBL_PREFIX']}users WHERE username='******'");
$row = Do_Fetch_Row($q);
if ($row[0] == "" && $_COOKIE['X2CHATP'] == $pass[0]) {
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}users VALUES('0','{$username}','','','1','','','','','','','','','14000,1000,1,1,0,3,1,0,0,1')");
echo mysql_error();
}
return $pass[0];
}
function TransactionQuery($sqlmultipleinput, $connection)
{
// turn off autocommit, and then start a transaction
mysqli_autocommit($connection, FALSE);
mysqli_begin_transaction($connection, MYSQLI_TRANS_START_READ_ONLY);
$i = 0;
$output = "";
foreach ($sqlmultipleinput as $sql) {
// replace SpecialLastID with mysql_insert_id($connection)
$sql = str_replace("SpecialLastID", "" . mysqli_insert_id($connection) . "", $sql);
//echo "Query = ".$sql."\n";
// do query
list($result, $valid) = DoQuery($sql, $connection);
$outout[$i] = array($result, $valid);
$i++;
}
// end commit transaction, and set autocommit for future
$transresult = mysqli_commit($connection);
mysqli_autocommit($connection, TRUE);
return array($transresult, $output);
}
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_winbg2','#b3b3b3')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_cs1','#cdcdcd')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_cs3','#cdcdcd')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_cs2','#000000')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_msgboxbg','#b3b3b3')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_ltfont','#000000')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_dkfont','#000000')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_deffont','#000000')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','bgimage','')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','news','')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','maxlog','1048576')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','defband','0')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_sysmsg','#ff0000')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_otherusers','#ff0000')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_youruser','#001068')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','serveroffset','0')");
} else {
}
}
}
printct(700, 700, "<font size=\"6\"><div align=\"center\">{$txt['249']}{$step}</div></font>", $body, "#CDCDCD", "#CDCDCD", "#EEEEEE");
?>
<div align="center"><Br><Br><Br>
<a href="http://www.x7chat.com"><img src="images/copyright.png" border="0"></a>
<Br><font size="2"><?php
echo $txt[76];
?>
</font>
<Br><font size="2"><?php
echo $txt[77];
?>
$msg = "[font={$fontface}]" . $msg . "[/font]";
if ($normal != "on") {
if ($italic == "on") {
$msg = "[i]" . $msg . "[/i]";
}
if ($bold == "on") {
$msg = "[b]" . $msg . "[/b]";
}
if (@$underline == "on") {
$msg = "[u]" . $msg . "[/u]";
}
}
$floodcount = 1;
$time = time();
$oldtime = time() - 1;
$q = DoQuery("SELECT * FROM {$SERVER['TBL_PREFIX']}messages WHERE user='******'NAME']}'");
while ($row = Do_Fetch_Row($q)) {
if ($row[3] == $time || $row[3] == $oldtime) {
$floodcount++;
}
}
if ($floodcount > $SERVER['MAX_MPS']) {
$to2 = "{$XUSER['NAME']}:PRIV";
$temp = $SERVER['MAX_MPS'] / 2;
$msg2 = "{$txt['309']} {$temp} {$txt['310']}";
sendsysmsgto($msg2, $to2);
} else {
if (isset($to)) {
$tmsg = eregi_replace("'", "\\'", $msg);
sendprivatemsg($tmsg, $to);
$submsg = codeparse($msg);
<?php
require_once "database.php";
$type = $_REQUEST["type"];
$ret = DoQuery($type);
echo $ret;
function DoQuery($t) {
$str = "{\"result\":0, \"data\":[";
$db = openConnection();
$stmt = $db->prepare("select id, nickname, comment, photo1, photo2, photo3, photo4, photo5, commit_date from feedback where status = ? order by id desc");
$stmt->bind_param("i", $t);
$stmt->execute();
$id = 0;
$nickname = "";
$comment = "";
$photo1 = "";
$photo2 = "";
$photo3 = "";
$photo4 = "";
$photo5 = "";
$commit_date = "";
$stmt->bind_result($id, $nickname, $comment, $photo1, $photo2, $photo3, $photo4, $photo5, $commit_date);
while ($stmt->fetch()) {
$str .= "{\"id\":${id},\"nickname\":".json_encode($nickname).",\"comment\":".json_encode($comment).",\"photo1\":\"${photo1}\",\"photo2\":\"${photo2}\",\"photo3\":\"${photo3}\",\"photo4\":\"${photo4}\",\"photo5\":\"${photo5}\",\"commit_date\":\"${commit_date}\"},";
}
$stmt->close();
closeConnection($db);
$str = rtrim($str, ",");
$str .= "]}";
}
if (!empty($_POST['number'])) {
$number = $_POST['number'];
$query .= " AND customers.number = '{$number}'";
}
if (!empty($_POST['postalcode'])) {
$postalcode = $_POST['postalcode'];
$query .= " AND customers.postalcode = '{$postalcode}'";
}
if (!empty($_POST['city'])) {
$city = $_POST['city'];
$query .= " AND customers.city = '{$city}'";
}
if (!empty($_POST['ccn'])) {
$ccn = $_POST['ccn'];
$query .= " AND customers.ccn = '{$ccn}'";
}
if (!empty($_POST['phone_number_1'])) {
$phone_number_1 = $_POST['phone_number_1'];
$query .= " AND customer_phone.phone_number = '{$phone_number_1}'";
} else {
if (!empty($_POST['phone_number_2'])) {
$phone_number_2 = $_POST['phone_number_2'];
$query .= " AND customer_phone.phone_number = '{$phone_number_2}'";
}
}
$query .= ";";
$customers = DoQuery($query);
include 'customers_vip.php';
include 'views/customers_view.php';
include 'views/footer.php';
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}settings SET value='#000000' WHERE name = 'style_cs2'");
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}settings SET value='#b3b3b3' WHERE name = 'style_msgboxbg'");
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}settings SET value='#000000' WHERE name = 'style_ltfont'");
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}settings SET value='#000000' WHERE name = 'style_dkfont'");
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}settings SET value='#000000' WHERE name = 'style_deffont'");
// Insert New Variables
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','bgimage','')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','news','')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','maxlog','1048576')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','defband','0')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_sysmsg','#ff0000')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_otherusers','#ff0000')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','style_youruser','#001068')");
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}settings VALUES('0','serveroffset','0')");
// Update old permissions table to allow admins to access bandwidth settings
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}permissions SET Edit_Bandwidth='1' WHERE user='******'");
if ($didfail == 1) {
$body .= "<br><br>{$txt['411']}<a href=\"upgrade.php?step=3&override=true\"><font color=\"#EEEEEE\">{$txt['40']}</font></a><Br>";
} else {
$body .= "<Br><Br>{$txt['412']}</div>";
}
}
printct(700, 700, "<font size=\"6\"><div align=\"center\">{$txt['408']}{$step}</div></font>", $body, "#CDCDCD", "#CDCDCD", "#EEEEEE");
?>
<div align="center"><Br><Br><Br>
<a href="http://www.x7chat.com"><img src="images/copyright.png" border="0"></a>
<Br><font size="2"><?php
echo $txt[76];
?>
</font>
<Br><font size="2"><?php
$error = 1;
}
if (strtoupper($username) == "DEFAULT_4" || strtoupper($username) == "DEFAULT_1") {
$body = "{$txt['194']}";
$error = 1;
}
$q = DoQuery("SELECT * FROM {$SERVER['TBL_PREFIX']}users WHERE email='{$email}'");
while ($row = Do_Fetch_Row($q)) {
$body = "{$txt['440']}";
$error = 1;
}
$pass1 = doXEncrypt($pass1);
if (!isset($error)) {
$q = DoQuery("SELECT value FROM {$SERVER['TBL_PREFIX']}settings WHERE name='serveroffset'");
$row = Do_Fetch_Row($q);
$settings = "14000,5000,1,1,0,3,1,{$row['0']},0,1";
$time = time();
$err = DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}users \nVALUES('0','{$username}','{$pass1}','{$email}','1','{$avatar}','{$realname}','{$location}',\n'{$hobbies}','{$bio}','','1','{$time}','{$settings}')");
if ($err == 1) {
$body = "<Br>{$txt['195']}<Br><Br><a href=\"index.php\">{$txt['196']}</a><Br><Br>";
} else {
$body = "Sorry a database error occured:<Br>{$err}<Br><Br>";
}
}
printct(700, 700, "<font size=\"6\"><div align=\"center\">{$txt['197']}</div></font>", "<div align=\"Center\">{$body}</div>", "{$CS['1']}", "{$CS['2']}", "{$CS['3']}");
?>
<Br><Br><Br>
<div align="center"><font size="2">Powered By <a href="http://www.x7chat.com/" target="_blank">X7 Chat</a> 1.3.6B<Br>© 2004 By The <a href="http://www.x7chat.com/" target="_blank">X7 Group</a></font></div>
</body>
</html>
} elseif ($action == "voice") {
$q = DoQuery("SELECT * FROM {$SERVER['TBL_PREFIX']}users WHERE id='{$userid}'");
$row = Do_Fetch_Row($q);
$q3 = DoQuery("SELECT * FROM {$SERVER['TBL_PREFIX']}online WHERE username='******'1']}'");
$row3 = Do_Fetch_Row($q3);
if ($row3[3] != $ROOMS['IN_ROOM_NAME']) {
$head = $txt[2];
$body = $txt[185];
} else {
if ($row[4] < 4 && $row[11] != $ROOMS['id']) {
mnotice($row[1], 5);
$head = $txt[186];
$body = "{$txt['187']}<Br><Br><a href=\"index.php\">{$txt['6']}</a><br><Br>";
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}users SET voice='{$ROOMS['id']}' WHERE id='{$userid}'");
} elseif ($row[11] == $ROOMS['id']) {
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}users SET voice='' WHERE id='{$userid}'");
mnotice($row[1], 6);
$head = $txt[188];
$body = "{$txt['189']}<Br><Br><a href=\"index.php\">{$txt['6']}</a><br><Br>";
} else {
$head = $txt[2];
$body = $txt[176];
}
}
}
printct(700, 700, "<font size=\"6\"><div align=\"center\">{$head}</div></font>", "<div align=\"center\">{$body}<Br><Br></div>", "{$CS['1']}", "{$CS['2']}", "{$CS['3']}");
?>
<Br><Br><Br>
<div align="center"><font size="2">Powered By <a href="http://www.x7chat.com/" target="_blank">X7 Chat</a> 1.3.6B<Br>© 2004 By The <a href="http://www.x7chat.com/" target="_blank">X7 Group</a></font></div>
</body>
</html>
include 'views/faq_view.php';
break;
case 6:
$query = "SELECT\n\t\t\t\th.name,h.city,h.rate\n\t\t\tFROM\n\t\t\t\thotels h,hotel_service hs\n\t\t\tWHERE\n\t\t\t\th.hotel_id=hs.hotel_id AND\n\t\t\t\ths.service='Wifi' AND\n\t\t\t\th.name\n\t\t\tIN (\n\t\t\t\tSELECT\n\t\t\t\t\th.name\n\t\t\t\tFROM\n\t\t\t\t\thotels h, hotel_service hs\n\t\t\t\tWHERE\n\t\t\t\t\th.hotel_id=hs.hotel_id AND\n\t\t\t\t\ths.service='Gym'\n\t\t\t\t);";
$results = DoQuery($query);
include 'views/faq_view.php';
break;
case 7:
$query = "SELECT\n\t\t\t\thotels.name, avg(salary),min(salary),max(salary)\n\t\t\tFROM \n\t\t\t\thotels CROSS JOIN employees\n\t\t\tON\n\t\t\t\thotels.hotel_id=employees.hotel_id\n\t\t\tGROUP BY\n\t\t\t\thotels.name;";
$results = DoQuery($query);
include 'views/faq_view.php';
break;
case 8:
$query = "SELECT\n\t\t\t\thotels.name, hotels.rate, avg(price),min(price),max(price)\n\t\t\tFROM \n\t\t\t\thotels CROSS JOIN rooms\n\t\t\tON\n\t\t\t\thotels.hotel_id=rooms.hotel_id\n\t\t\tGROUP BY\n\t\t\t\thotels.name;";
$results = DoQuery($query);
include 'views/faq_view.php';
break;
case 9:
$query = "SELECT \n\t\t\t\thotels.name, hotels.rate\n\t\t\tFROM\n\t\t\t\thotels\n\t\t\tWHERE\n\t\t\t\thotels.construction_year>2000\n\t\t\tORDER BY\n\t\t\t\thotels.rate DESC;";
$results = DoQuery($query);
include 'views/faq_view.php';
break;
case 10:
$query = "SELECT\n\t\t\t\tc.name, c.surname , count(*)\n\t\t\tFROM\n\t\t\t\tcustomers c, reservations r \n\t\t\tWHERE\n\t\t\t\tr.customer_id=c.customer_id\n\t\t\tGROUP BY\n\t\t\t\tr.customer_id;";
$results = DoQuery($query);
include 'views/faq_view.php';
break;
default:
echo "<div class='error'>Μη έγκυρο ερώτημα!</div>";
}
include 'views/footer.php';
<?php
require_once "database.php";
$nickname = $_REQUEST["nickname"];
$comment = $_REQUEST["comment"];
$photo1 = $_FILES["photo1"];
$photo2 = $_FILES["photo2"];
$photo3 = $_FILES["photo3"];
$photo4 = $_FILES["photo4"];
$photo5 = $_FILES["photo5"];
$ret = DoQuery($nickname, $comment, $photo1, $photo2, $photo3, $photo4, $photo5);
echo $ret;
function DoQuery($n, $c, $p1, $p2, $p3, $p4, $p5) {
$str = "{\"result\":1}";
date_default_timezone_set("Asia/Hong_Kong");
$t_str = date("YmdHis");
$commit_date = date("Y-m-d H:i:s");
$pname = generateToken().".${t_str}.";
$path1 = "./files/${pname}1";
$path2 = "./files/${pname}2";
$path3 = "./files/${pname}3";
$path4 = "./files/${pname}4";
$path5 = "./files/${pname}5";
$dbp1 = "";
$dbp2 = "";
$dbp3 = "";
$dbp4 = "";
$dbp5 = "";
}
if (!empty($_POST['city'])) {
$city = $_POST['city'];
$query .= " AND city = '{$city}'";
}
if (!empty($_POST['rate'])) {
$rate = $_POST['rate'];
$query .= " AND rate = '{$rate}'";
}
if (!empty($_POST['constructiondate'])) {
$constructiondate = $_POST['constructiondate'];
$query .= " AND construction_year = '{$constructiondate}'";
}
if (!empty($_POST['renovationdate'])) {
$renovationdate = $_POST['renovationdate'];
$query .= " AND renovation_year = '{$renovationdate}'";
}
if (!empty($_POST['phone_number_1'])) {
$phone_number_1 = $_POST['phone_number_1'];
$query .= " AND hotel_phone.phone_number = '{$phone_number_1}'";
} else {
if (!empty($_POST['phone_number_2'])) {
$phone_number_2 = $_POST['phone_number_2'];
$query .= " AND hotel_phone.phone_number = '{$phone_number_2}'";
}
}
$query .= ";";
$hotels = DoQuery($query);
include 'hotels_services.php';
include 'views/hotels_view.php';
include 'views/footer.php';
<?php
// get environment
require '../php/core.php';
require '../php/connection.php';
// get the link check
$linkcheck = ValidateArgument("q", $connection);
// must be perfect length
if (strlen($linkcheck) === 2 * 32 + 1) {
// check for duplicate emails
$sql = "SELECT idUsers from Users WHERE Confirmed = '0' AND VerifyLink = '" . $linkcheck . "' AND VerifyTimeout > '" . time() . "' AND idUsers > 0;";
// parallel assignment short cut
list($result, $valid) = DoQuery($sql, $connection);
// must be valid query, but returned 0 rows
if ($result && $valid) {
$sqlUpdate = "UPDATE Users SET Confirmed = '1', VerifyTimeout = '0', VerifyLink = '0' WHERE VerifyLink = '" . $linkcheck . "';";
// parallel assignment short cut
list($resultUpdate, $validUpdate) = DoQuery($sqlUpdate, $connection);
// forego processing of error here...
header("Location: ../index.html?verified=1");
} else {
header("Location: ../index.html?error=");
}
} else {
header("Location: ../index.html");
}
// output and close
mysqli_close($connection);
} else {
$total = $total . $ext;
}
$body .= '<table border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="100"> <b>' . $txt[435] . '</b> </td>
<td width="150">' . $total . '</td>
<td width="150"> </td>
<td width="200"> </td>
</tr>';
$body .= "</table><Br>{$txt['434']}<Br><Br>";
} elseif ($action == "editbandwidth") {
$head = $txt[428];
if (isset($user) && isset($newband)) {
$body = "<Br>{$txt['438']}<Br><Br>";
if ($newband != "d") {
$newband = $newband * 1024 * 1024;
}
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}bandwidth SET allowed='{$newband}' WHERE user='******'");
} else {
$body = "<Br>{$txt['439']}<Br><Br>";
}
}
}
printct(700, 700, "<font size=\"6\"><div align=\"center\">{$head}</div></font>", "<div align=\"center\">{$prebody}{$body}<Br><Br></div>", "{$CS['1']}", "{$CS['2']}", "{$CS['3']}");
?>
<Br><Br><Br>
<div align="center"><font size="2">Powered By <a href="http://www.x7chat.com/" target="_blank">X7 Chat</a> 1.3.6B<Br>© 2004 By The <a href="http://www.x7chat.com/" target="_blank">X7 Group</a></font></div>
</body>
</html>
// check for duplicate emails
$sqlDuplicateEmail = "SELECT idUsers from Users WHERE Email = '" . $login_email . "' AND idUsers > 0;";
// parallel assignment short cut
list($result, $valid) = DoQuery($sqlDuplicateEmail, $connection);
// must be valid query, but returned 0 rows
if ($result && !$valid) {
// do a bcrypt ,cost=11, with random salt, and generate another salt too
$login_salt = mcrypt_create_iv(22, MCRYPT_DEV_URANDOM);
$options = ['cost' => 11, 'salt' => mcrypt_create_iv(22, MCRYPT_DEV_URANDOM)];
$login_hashed = password_hash($login_password, PASSWORD_BCRYPT, $options);
$verifyrandom = md5(rand()) . "x" . md5(rand());
// make insert statement
$login_username = $login_firstname . " " . $login_lastname;
$sqlNew = "INSERT INTO Users (UserName, FirstName, LastName, Email, HashPassword, Confirmed, Level, Salt, VerifyLink, VerifyTimeout) VALUES \n (\n '" . $login_username . "', \n '" . $login_firstname . "', \n '" . $login_lastname . "', \n '" . $login_email . "', \n '" . $login_hashed . "', \n '0',\n '1',\n '" . $login_salt . "', \n '" . $verifyrandom . "', \n '" . (time() + 60 * 60) . "' \n );";
// parallel assignment short cut
list($resultB, $validB) = DoQuery($sqlNew, $connection);
// now query must be good
if ($resultB) {
// Instantiate the client.
$mg = new Mailgun(getenv("MAILGUN_API_KEY"));
$domain = getenv("MAILGUN_DOMAIN");
// okay now, send a link to their email, asking for confirmation
$verify_link = "https://assist-me.herokuapp.com/php/verify.php?q=" . $verifyrandom;
$response = $mg->sendMessage($domain, array('from' => "Assist-Me <*****@*****.**>", 'to' => $login_email, 'subject' => "Assist-Me: Account Confirmation for " . $login_username . "", 'text' => "Hello " . $login_firstname . "\n", 'html' => "<html>Please follow this link to confirm your account:\n<a href='" . $verify_link . "'>Click ME!</a>\n\nIf this email was sent to you in error, please ignore it.</html>"));
header("Location: ../index.html");
} else {
header("Location: ../index.html?error=3");
}
} else {
header("Location: ../index.html?error=2");
}
?>
" vlink="<?php
echo $CS['FONTLT'];
?>
" alink="<?php
echo $CS['FONTLT'];
?>
">
<?php
$head = "{$txt['284']}";
$body = "{$txt['285']}";
printct(700, 700, "<font size=\"6\"><div align=\"center\">{$head}</div></font>", "\n<div align=\"Center\">{$body}\n<Br><Br></div>", $CS[1], $CS[2], $CS[3]);
exit;
}
$roomsifplusedbyone = 0;
$q = DoQuery("SELECT * FROM {$SERVER['TBL_PREFIX']}rooms");
while ($row = Do_Fetch_Row($q)) {
$roomsifplusedbyone++;
}
if (@$XUSER['LEVEL'] >= 4 && @$terminalerror2 == 1) {
$terminalerror2 = 0;
}
cleanPMS();
// Sick function name but what it does is clear the Private Messages
// Begin buffer flush to users web browser, this is done so that the login
// works correctly and they do not get HEADER OUTPUT errors. Editing this
// line will cause login to fail
ob_end_flush();
eval(base64_decode("JGNoZWF0aW5nID0gMDsKaWYoJGNmID0gQGZpbGUoImxpYi9odG1sLnBocCIpKXsKCSRjZiA9IGltcGxvZGUoIiIsJGNmKTsKCWlmKCFlcmVnaSgiPGRpdiBhbGlnbj1cImNlbnRlclwiPjxmb250IHNpemU9XCIyXCI+UG93ZXJlZCBCeSA8YSBocmVmPVwiaHR0cDovL3d3dy54N2NoYXQuY29tL1wiIHRhcmdldD1cIl9ibGFua1wiPlg3IENoYXQ8L2E+IDEuMy42QjxCcj4mY29weTsgMjAwNCBCeSBUaGUgPGEgaHJlZj1cImh0dHA6Ly93d3cueDdjaGF0LmNvbS9cIiB0YXJnZXQ9XCJfYmxhbmtcIj5YNyBHcm91cDwvYT48L2ZvbnQ+PC9kaXY+IiwkY2YpKXsKCQkkY2hlYXRpbmcgPSAxOwoJfQp9CmlmKCRjZiA9IEBmaWxlKCJmcmFtZXMvbmV3LnRvcC5waHAiKSl7CgkkY2YgPSBpbXBsb2RlKCIiLCRjZik7CglpZighZXJlZ2koIjxkaXYgYWxpZ249XCJjZW50ZXJcIj48Zm9udCBzaXplPVwiMlwiPlBvd2VyZWQgQnkgPGEgaHJlZj1cImh0dHA6Ly93d3cueDdjaGF0LmNvbS9cIiB0YXJnZXQ9XCJfYmxhbmtcIj5YNyBDaGF0PC9hPiAxLjMuNkI8QnI+JmNvcHk7IDIwMDQgQnkgVGhlIDxhIGhyZWY9XCJodHRwOi8vd3d3Lng3Y2hhdC5jb20vXCIgdGFyZ2V0PVwiX2JsYW5rXCI+WDcgR3JvdXA8L2E+PC9mb250PjwvZGl2PiIsJGNmKSl7CgkJJGNoZWF0aW5nID0gMTsKCX0KfQppZigkY2hlYXRpbmcgPT0gMSkKCWVjaG8gIlRoZSBzY3JpcHQgaGFzIGRldGVjdGVkIHRoYXQgdGhlIFg3IENoYXQgY29weXJpZ2h0IHdhcyBpbGxlZ2FsbHkgcmVtb3ZlZC4gIElmIHlvdSBiZWxpZXZlIHlvdSBhcmUgZ2V0dGluZyB0aGlzIG1lc3NhZ2UgaW4gZXJyb3IgcGxlYXNlIHZpc2l0IG91ciBmb3J1bSBhdCBodHRwOi8vZm9ydW0ueDdjaGF0LmNvbS8gYW5kIHJlcG9ydCBpdC4iOw=="));
// Check if user has exceeded bandwidth limit.
$bused = logBandwidth(0);
?>
" link="<?php
echo $CS['FONTLT'];
?>
" vlink="<?php
echo $CS['FONTLT'];
?>
" alink="<?php
echo $CS['FONTLT'];
?>
">
<?php
$head = $txt[308];
if (!isset($invitewho)) {
$body = "<Br>\n<form action=\"index.php?doinvite=1\" method=\"post\">\n<select name=\"invitewho\">";
$q = DoQuery("SELECT username FROM {$SERVER['TBL_PREFIX']}online WHERE roomname!='{$ROOMS['IN_ROOM_NAME']}'");
while ($row = Do_Fetch_Row($q)) {
$body .= "<option value=\"{$row['0']}\">{$row['0']}</option>";
}
$body .= "</select> <input type=\"submit\" value=\"{$txt['308']}\"></form>";
$body .= "<Br><a href=\"index.php\">{$txt['6']}</a>";
} else {
$invitewho = eregi_replace("'", "\\'", $invitewho);
irc("/invite {$invitewho}");
$body = "<Br><a href=\"index.php\">{$txt['6']}</a>";
}
printct(700, 700, "<font size=\"6\"><div align=\"center\">{$head}</div>", "\n<div align=\"Center\">{$body}\n<Br><Br></div>", "{$CS['1']}", $CS[2], "{$CS['3']}");
}
?>
<Br><Br><Br>
<div align="center"><font size="2">Powered By <a href="http://www.x7chat.com/" target="_blank">X7 Chat</a> 1.3.6B<Br>© 2004 By The <a href="http://www.x7chat.com/" target="_blank">X7 Group</a></font></div>
function getPass($username)
{
global $table_prefix, $DATABASE;
@DoConnect(XOOPS_DB_HOST, XOOPS_DB_USER, XOOPS_DB_PASS);
@DoSelectDb(XOOPS_DB_NAME);
$q = DoQuery("SELECT pass FROM {$table_prefix}users WHERE uname='{$username}'");
$pass = Do_Fetch_Row($q);
DoConnect($DATABASE['HOST'], $DATABASE['USER'], $DATABASE['PASS']);
DoSelectDb($DATABASE['DATABASE']);
if ($pass[0] == "") {
$q = DoQuery("SELECT email,password FROM {$SERVER['TBL_PREFIX']}users WHERE username='******'");
$row = Do_Fetch_Row($q);
if ($row[0] == "Guest") {
$pass[0] = $row[1];
}
}
return $pass[0];
}
</tr>
</table>
</div>
<?php
} elseif ($page == "update") {
// We don't need 1000000 popups coming up do we? no, lets change that
$q = DoQuery("SELECT * FROM {$SERVER['TBL_PREFIX']}pmsessions WHERE user='******'NAME']}' AND fromuser='******'");
$row = Do_Fetch_Row($q);
$time = time();
if ($row[0] == "") {
$update = 0;
DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}pmsessions VALUES('0','{$XUSER['NAME']}','{$user}','{$time}','1')");
} else {
$update = $row[3];
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}pmsessions SET time='{$time}' WHERE id='{$row['0']}'");
}
?>
<script language="javascript" type="text/javascript">
<?php
?>
if(window.parent.frames['pm_mw'].issent == 1){
window.parent.frames['pm_mw'].document.write('<html><head></head><body bgcolor="<?php
echo $CS['WIN_BG_2'];
?>
"><?php
$returned = getprivatemessages($update - 1000);
echo $returned[$user];
?>
');
}else{
function logBandwidth($size)
{
global $SERVER, $XUSER;
$month = date("m");
$q = DoQuery("SELECT bandwidth,allowed,month FROM {$SERVER['TBL_PREFIX']}bandwidth WHERE user='******'NAME']}'");
$row = Do_Fetch_Row($q);
if ($row[0] == "") {
$q = DoQuery("INSERT INTO {$SERVER['TBL_PREFIX']}bandwidth VALUES('0','{$XUSER['NAME']}','{$month}','0','d')");
$row[0] = 0;
$row[1] = "d";
$row[2] = $month;
}
// reset if its a new month
if ($row[2] != $month) {
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}bandwidth SET month={$month},bandwidth=0 WHERE user='******'NAME']}'");
$row[0] = 0;
}
// record new bandwdith
$newbandwidth = $row[0] + $size;
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}bandwidth SET bandwidth={$newbandwidth} WHERE user='******'NAME']}'");
// See if user has gone over limit
if ($row[1] == "d") {
$row[1] = $SERVER['DEFAULT_BAND_LIMIT'];
}
if ($row[1] != 0) {
if ($newbandwidth >= $row[1] && ($XUSER['LEVEL'] != 4 && $XUSER['LEVEL'] != 5)) {
return 0;
} else {
return 1;
}
}
return 1;
}
<?php
require_once "database.php";
$ret = DoQuery();
echo $ret;
function DoQuery() {
$str = "{\"result\":0, \"data\":[";
$db = openConnection();
$stmt = $db->prepare("select * from thanks order by id asc");
$stmt->execute();
$id = 0;
$name = "";
$desc = "";
$desc_en = "";
$head = "";
$stmt->bind_result($id, $name, $desc, $desc_en, $head);
while ($stmt->fetch()) {
$str .= "{\"id\":${id},\"name\":".json_encode($name).",\"desc\":".json_encode($desc).",\"desc_en\":".json_encode($desc_en).",\"head\":\"${head}\"},";
}
$stmt->close();
closeConnection($db);
$str = rtrim($str, ",");
$str .= "]}";
return $str;
}
?>
echo $ONLINE['USERS'] + $ONLINE['ADMIN'];
?>
';
window.parent.frames['left_top'].document.showon.rooms.value='<?php
echo $ROOMS['TOTAL_ROOMS'];
?>
';
<?php
if ($XUSER['POPUPPM'] == 1) {
$q = DoQuery("SELECT fromuser,id FROM {$SERVER['TBL_PREFIX']}pmsessions WHERE user='******'NAME']}' AND isopen='0'");
while ($row = Do_Fetch_Row($q)) {
if ($row[0] != "") {
$session = time() . strlen($row[0]);
print "window.open('privatemessage.php?user={$row['0']}','PM{$session}','width=600,height=300');";
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}pmsessions SET isopen='1' WHERE id='{$row['1']}'");
}
}
}
} else {
if (isset($pincorrect)) {
print "This chat room requires a password. <a href=\"../index.php\" target=\"_parent\">Click Here</a> to enter it.";
}
}
cleanmsgs();
$RV = printinroom();
$usersonline = $RV[0];
$number = $RV[1];
// Check to see if update of online list is needed
?>
if(window.parent.frames['right_mid'].numonline != <?php
irc("/deadmin {$doto}");
redirect();
}
} elseif ($umaction == "gop") {
if ($XUSER['LEVEL'] == 3 || $XUSER['LEVEL'] == 4 || $XUSER['LEVEL'] == 5) {
irc("/op {$doto}");
redirect();
}
} elseif ($umaction == "startlog") {
if ($XUSER['LEVEL'] == 3 || $XUSER['LEVEL'] == 4 || $XUSER['LEVEL'] == 5) {
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}rooms SET encrypted='1' WHERE name='{$ROOMS['IN_ROOM_NAME']}'");
redirect();
}
} elseif ($umaction == "stoplog") {
if ($XUSER['LEVEL'] == 3 || $XUSER['LEVEL'] == 4 || $XUSER['LEVEL'] == 5) {
DoQuery("UPDATE {$SERVER['TBL_PREFIX']}rooms SET encrypted='0' WHERE name='{$ROOMS['IN_ROOM_NAME']}'");
redirect();
}
} elseif ($umaction == "clearlog") {
if ($XUSER['LEVEL'] == 3 || $XUSER['LEVEL'] == 4 || $XUSER['LEVEL'] == 5) {
clearLog($ROOMS['IN_ROOM_NAME']);
redirect();
}
} elseif ($umaction == "top") {
if ($XUSER['LEVEL'] == 3 || $XUSER['LEVEL'] == 4 || $XUSER['LEVEL'] == 5) {
irc("/deop {$doto}");
redirect();
}
} elseif ($umaction == "invite") {
echo "inviting {$doto}";
?>
//Get the query information
$sSQL = "SELECT * FROM query_qry WHERE qry_ID = " . $iQueryID;
$rsSQL = RunQuery($sSQL);
extract(mysql_fetch_array($rsSQL));
//Get the parameters for this query
$sSQL = "SELECT * FROM queryparameters_qrp WHERE qrp_qry_ID = " . $iQueryID;
$rsParameters = RunQuery($sSQL);
//If the form was submitted or there are no parameters, run the query
if (isset($_POST["Submit"]) || mysql_num_rows($rsParameters) == 0) {
//Check that all validation rules were followed
ValidateInput();
//Any errors?
if (count($aErrorText) == 0) {
//No errors; process the SQL, run the query, and display the results
ProcessSQL();
DoQuery();
} else {
//Yes, there were errors; re-display the parameter form (the DisplayParameterForm function will
//pick up and display any error messages)
DisplayQueryInfo();
DisplayParameterForm();
}
} else {
//Display the parameter form
DisplayQueryInfo();
DisplayParameterForm();
}
//Loops through all the parameters and ensures validation rules have been followed
function ValidateInput()
{
global $rsParameters;
" colspan="2" height="5"><img height="5" src="./images/spacer.gif"></td>
</tr>
<tr valign="top">
<td bgcolor="<?php
echo $CS['WIN_BG_1'];
?>
" width="5"><img width="5" src="./images/spacer.gif"></td>
<td width="196" height="79" bgcolor="<?php
echo $CS['2'];
?>
" style="border: 1px solid <?php
echo $CS[3];
?>
;"><?php
$smstart = 0;
$tsmilies = 0;
$smilies = "";
$q = DoQuery("SELECT * FROM {$SERVER['TBL_PREFIX']}filter WHERE type='1' LIMIT {$smstart},52");
while ($row = Do_Fetch_Row($q)) {
$row[3] = eregi_replace("^../", "./", $row[3]);
$smilies .= "<img src=\"{$row['3']}\" onclick=\"javascript: smclick('{$row['2']}')\" height=\"15\" width=\"15\">";
$tsmilies++;
}
print "<font color=\"{$CS['FONTLT']}\">{$smilies}";
?>
</td>
</tr>
</table>
</body>
</html>
