I've created this login admin page. Can you help me to tell if can be hacked and how ?
It is vulnerable to sql injection ?
- Code: Select all
<?php
include_once('../_config/_config.php');
include_once('../_library/_library.php');
load_helpers(array('_mysql','_validation','_mailer','_template'),'../');
$template =new Template('_template');
$validation =new Validation;
$mail =new PHPMailer();
$database =new MySQL(true, ''.DATABASE.'', ''.HOST.'', ''.USERNAME.'', ''.PASSWORD.'');
if ($database->Error()) $database->Kill();
$er_login='';
$no_login='';
$er_recover='';
$no_recover='';
$ok='';
$show='';
if(isset($_POST['login'])) {
$source= array(
'username' => @$_POST['username'],
'parola' => @$_POST['password']
);
$rules = array(
'username'=>array('type'=>'string', 'required'=>true, 'min'=>1, 'max'=>50, 'trim'=>true),
'parola' =>array('type'=>'string', 'required'=>true, 'min'=>1, 'max'=>50, 'trim'=>true)
);
$validation->addSource($source);
$validation->addRules($rules);
$validation->run();
if(sizeof($validation->errors) > 0)
{
$er_login=$validation->errors;
} else {
$database->Query("SELECT `username`, `level` FROM admin WHERE `username`='".$validation->sanitized['username']."' AND `password`='".md5($validation->sanitized['parola'])."' AND active='1' LIMIT 1");
if($database->RowCount()==1) {
$admin=$database->RowArray(0, MYSQL_ASSOC);
$_SESSION['ADMIN']=$admin['username'];
$_SESSION['LEVEL']=$admin['level'];
header('Location: '.SITE.'/admin/home/');
exit();
} else {
$no_login='Datele de logare in partea de administrare sunt incorecte!';
}
}
}
if(isset($_POST['recover'])) {
$source= array(
'username' => @$_POST['username'],
'email' => @$_POST['email']
);
$rules = array(
'username'=>array('type'=>'string', 'required'=>true, 'min'=>1, 'max'=>50, 'trim'=>true),
'email' =>array('type'=>'string', 'required'=>true, 'min'=>1, 'max'=>50, 'trim'=>true)
);
$validation->addSource($source);
$validation->addRules($rules);
$validation->run();
if(sizeof($validation->errors) > 0)
{
$er_recover=$validation->errors;
} else {
$database->Query("SELECT `username`, `email`, `ID` FROM admin WHERE `username`='".$validation->sanitized['username']."' AND `email`='".$validation->sanitized['email']."' AND active='1' LIMIT 1");
if($database->RowCount()==1) {
$data=$database->RowArray(0, MYSQL_ASSOC);
$password=random_string('alnum',8);
$database->Query("UPDATE admin SET `password`='".md5($password)."' WHERE ID='".$data['ID']."' LIMIT 1");
