introduced html password fields.

[banana.git] / include / usercheck.inc

diff --git a/include/usercheck.inc b/include/usercheck.inc
index e6cab54ec48fcd3763a560889db873d0178cb173..26ab85111b161450124d15266ea3dff67a1c18ac 100644 (file)
--- a/include/usercheck.inc
+++ b/include/usercheck.inc
@@ -1,22 +1,29 @@
 <?php
 <?php

+

   require 'db.inc';
   require 'db.inc';

+  require 'common.inc';

 
   $mnumber = $_POST['mnumber'];
   $password = $_POST['password'];
 
 
   $mnumber = $_POST['mnumber'];
   $password = $_POST['password'];
 

+  if(! is_numeric($mnumber)) {
+    block("red", "Matr.nummer has to be numeric!");
+    exit;
+  }
+

   if($db->query("SELECT COUNT(*) FROM students WHERE mnumber = $mnumber")->fetch(PDO::FETCH_NUM)[0] == 0) {
     print '<table bgcolor="red">';
       print '<tr><th><b><font color="white">Mat.nummer not found</font></b></th><tr>';
     print '</table>';
     print "Mat.Nummer was not found. You have to register first!";
   if($db->query("SELECT COUNT(*) FROM students WHERE mnumber = $mnumber")->fetch(PDO::FETCH_NUM)[0] == 0) {
     print '<table bgcolor="red">';
       print '<tr><th><b><font color="white">Mat.nummer not found</font></b></th><tr>';
     print '</table>';
     print "Mat.Nummer was not found. You have to register first!";

-    break;
+    exit;

   }
 
   if($db->query("SELECT COUNT(*) FROM students WHERE mnumber = $mnumber AND password = \"$password\"")->fetch(PDO::FETCH_NUM)[0] == 0) {
     print '<table bgcolor="red">';
       print '<tr><th><b><font color="white">wrong password</font></b></th><tr>';
     print '</table>';
   }
 
   if($db->query("SELECT COUNT(*) FROM students WHERE mnumber = $mnumber AND password = \"$password\"")->fetch(PDO::FETCH_NUM)[0] == 0) {
     print '<table bgcolor="red">';
       print '<tr><th><b><font color="white">wrong password</font></b></th><tr>';
     print '</table>';

-    break;
+    exit;

   }
   
 ?>
\ No newline at end of file
   }
   
 ?>
\ No newline at end of file