<?php
$INFO['SQLHost'] = '
';
$INFO['SQLUID'] = 'sa';
$INFO['SQLPWD'] = '
';
$INFO['SQLDB'] = 'OdinAccounts';
if (isset($_GET['Username']) && isset($_GET['Password'])){
$user = sql_clean($_GET['Username']);
$pass = sql_clean($_GET['Password']);
}else{
echo 'error';
exit();
}
$con = $connectionInfo = array( "Database"=>$INFO['SQLDB'], "UID"=>$INFO['SQLUID'], "PWD"=>$INFO['SQLPWD']);
$conn = sqlsrv_connect( $INFO['SQLHost'], $connectionInfo);
$exec = sqlsrv_query($conn, "SELECT nEMID, sUserPass FROM tAccounts WHERE sUsername = ?", array($user), array( "Scrollable" => SQLSRV_CURSOR_KEYSET ));
if($exec)
{
if(sqlsrv_num_rows($exec) != 1)
{
die('Account Not Found!');
}
$AccountData = sqlsrv_fetch_array($exec);
$PlaintxtPass = $AccountData['sUserPass'];
$PlaintxtnEMID = $AccountData['nEMID'];
if ($PlaintxtPass == $pass)
{
$Token = RandomToken(50);
$setToken = null;
$checkTokensRows = sqlsrv_query($conn, "SELECT * FROM tTokens WHERE nEMID = ?", array($PlaintxtnEMID), array( "Scrollable" => SQLSRV_CURSOR_KEYSET ));
if (sqlsrv_num_rows($checkTokensRows) >= 1)
{
sqlsrv_query($conn, "DELETE FROM tTokens WHERE nEMID = ?;", array($PlaintxtnEMID));
$setToken = sqlsrv_query($conn, "INSERT INTO tTokens (nEMID, sToken) VALUES(?, ?);", array($PlaintxtnEMID, $Token));
}
else
{
$setToken = sqlsrv_query($conn, "INSERT INTO tTokens (nEMID, sToken) VALUES(?, ?);", array($PlaintxtnEMID, $Token));
}
if ($setToken){
die('OK#'.$Token);
}else{
die('SetToken Error'.print_r(sqlsrv_errors(), True));
}
}
else
{
die('Wrong Password!');
}
}
else
{
die('Query Failed');
}
function sql_clean($str)
{
$search = array("\\", "\0", "\n", "\r", "\x1a", "'", '"');
$replace = array("", "", "", "", "", "", "");
return str_replace($search, $replace, $str);
}
function RandomToken( $length )
{
$chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVW XYZ0123456789";
$str = "";
$size = strlen( $chars );
for( $i = 0; $i < $length; $i++ ) {
$str .= $chars[ rand( 0, $size - 1 ) ];
}
return $str;
}
?>
