Member / Login script

[code]-------------------------
setup.php
-------------------------

<?php

if($_SERVER['REQUEST_METHOD'] == 'POST'){
	$password['pass'] = md5($_POST['login_pass']);
	$password['check'] = md5($_POST['login_pass_check']);
	$login_name = addslashes(htmlspecialchars($_POST['login_name']));
	
	if(!empty($_POST['login_name']) AND $password['pass'] == $password['check']){
		# account maken:
 		!is_dir('members') ? mkdir('members', 0777) : null;
  
  		$handle = fopen('members/' . $login_name . '.php','w');
  		fwrite($handle, "<?php \$password = \"" . $password['pass'] . "\";\n \$email=\"".htmlentities($_POST['email'], ENT_QUOTES)."\"; ?>");
  		fclose($handle);
  
  		$website = htmlentities($_POST['website'], ENT_QUOTES);
  		$afzender = $_POST['afzender'];
  		$pagina = $_POST['pagina'];
    
  		$handle = fopen('config.php','w');
  		fwrite($handle, "<?php\n \$website = \"" . $website . "\";\n \$afzender = \"" . $afzender . "\";\n \$pagina = \"" . $pagina . "\";\n ?>");
  		fclose($handle);
  
  		echo "<h1>Succes!</h1>\n<p>Please delete setup.php!</p>\n";
  	}else{
  		echo "<h1>Foutje</h1>\n<p>Probeer het opnieuw.</p>\n";
	}
}else{
?>

<form method="post" action="#">

 <h1>Create Admin account</h1>
 
 <p>
  <fieldset>
   <legend>Setup Information</legend>
   <p>Wat is de naam van je website?<br /><input type="text" name="website" value='mijnwebsite' /></p>
   <p>Er wordt een registratie mail met het password verzonden, wat is de afzender van deze mail?<br /><input type="text" name="afzender" value='[email protected]' /></p>
   <p>Naar welke pagina moet er worden gegaan na het inloggen?<br /><input type="text" name="pagina" value='logged.php' /></p>
  </fieldset>
 </p>
 
 <p>
  <fieldset>
   <legend>Your Information</legend> 
   <p>Username:<br /><input type="text" name="login_name" maxlength="20" /></p>
   <p>Password:<br /><input type="password" name="login_pass" maxlength="20" /></p>
   <p>Retype Password:<br /><input type="password" name="login_pass_check" maxlength="20" /></p>
   <p>E-mail: <br /><input type="text" name="email"></p>
  </fieldset>
 </p>
 
 <p><input type="submit" name="submit" value="Setup"></p>

</form>

<?php
}
?>

-------------------------
register.php
-------------------------

<?php

function mkpass(){
	$letters = array();
	$tekens['klein'] = range('a','z');
	$tekens['groot'] = range('A','Z');
	$tekens['cijfers'] = range(0,9);
	
	foreach($tekens['klein'] as $k => $v){
		array_push($letters, $v);
	}
	
	foreach($tekens['groot'] as $k => $v){
  		array_push($letters, $v);
  	}
  	
  	foreach($tekens['cijfers'] as $k => $v){
		array_push($letters, $v);
	}
	
	$aantal = count($letters)-1;
 
 	return $letters[rand(0,$aantal)] . $letters[rand(0,$aantal)] . $letters[rand(0,$aantal)] . $letters[rand(0,$aantal)] . $letters[rand(0,$aantal)] . $letters[rand(0,$aantal)] .  $letters[rand(0,$aantal)] . $letters[rand(0,$aantal)];
}

if($_SERVER['REQUEST_METHOD'] == 'POST'){
 
	if(empty($_POST['login_name']) OR empty($_POST['email'])){
		echo "<h1>Error</h1>\n<p>You did not fill in all required fields!</p>\n";
	}else{
		$username = htmlentities($_POST['login_name'], ENT_QUOTES);
		$password = mkpass();
		$email = htmlentities($_POST['email'], ENT_QUOTES);
		
		if(file_exists('members/' . $username . '.php')){
 			echo "<h1>Error</h1>\n<p>Username already in use!</p>\n"; 
		}else{
   			include('config.php');
   
			$onderwerp = "Registration at " . $website;
   
   			$bericht = "Welcome to " . $website . "\r\n\r\nPlease keep this email for your records. Your account information is as follows:\r\n\r\n----------------------------\r\nUsername: " . $username . "\r\nPassword: " . $password . "\r\n----------------------------\r\n\r\nThank you for registering.";
   
			mail($email, $onderwerp, $bericht, "From: " . $afzender . "\nX-Mailer: PHP/" . phpversion(), "-f " . $afzender);
   
   			$handle = fopen('members/' . $username . '.php','w');
   			fwrite($handle, "<?php\n \$password = \"" . md5($password) . "\";\n \$email = \"" . $email . "\";\n ?>");
   			fclose($handle);
   
   			echo "<h1>Succes</h1>\n<p>Please check your email for your password!</p>\n";
   		}
	}
}else{
?>

<form method="post" action="#">

 <h1>Create account</h1>
 <p>Username:<br /><input type="text" name="login_name" maxlength="20" /></p>
 <p>E-mail:<br /><input type="text" name="email" /></p>
 <p><input type="submit" name="submit" value="Register" /></p>

</form>

<?
}
?>

-------------------------
login.php
-------------------------

<?php

session_start();

if(file_exists('setup.php')){
	exit("<h1>Error</h1>\n<p>You must delete <strong>setup.php</strong> first.</p>\n");
}

require_once('config.php');

if(isset($_SESSION['name'])){
	header('Location: '.$pagina);
}

if($_SERVER['REQUEST_METHOD'] == 'POST'){
 
	if(!empty($_POST['login_name']) AND !empty($_POST['login_pass']) AND file_exists('members/' . htmlentities($_POST['login_name'], ENT_QUOTES) . '.php')){
		$login['name'] = htmlentities($_POST['login_name'], ENT_QUOTES);
		$login['pass'] = md5($_POST['login_pass']);
  
  		require_once('members/' . htmlentities($login['name'], ENT_QUOTES) . '.php');
  
  		if($password == $login['pass']){
   			$_SESSION['name'] = htmlentities($login['name'], ENT_QUOTES);
   			$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
   
   			header("Location: " . $pagina);
   		}else {
   			echo "<h1>Error</h1>\n<p>Wrong password.</p>\n";
   		}
	}else{
  		echo "<h1>Error</h1>\n<p>Login incorrect, please try again!</p>\n";
	}
}else{
?>

<form method="post" action="#">

 <h1>Login</h1>
 <p>Username:<br /><input type="text" name="login_name" maxlength="20" /></p>
 <p>Password:<br /><input type="password" name="login_pass" maxlength="20" /></p>
 <p><input type="submit" name="submit" value="Login" /></p>

</form>
<?php
}
?>

-------------------------
check.php  
-------------------------

<?php

/*
* Require deze pagina bovenaan iedere pagina die alleen voor members toegankelijk mag zijn.
* Dit moet helemaal bovenaan, omdat anders de session_start() & header() functie niet werken.
*/

session_start();

if(!isset($_SESSION['name']) OR $_SESSION['ip'] != $_SERVER['REMOTE_ADDR']){
	header('Location: logoff.php');
}else {
	require_once('members/' . $_SESSION['name'] . '.php');
}

?>

-------------------------
logoff.php
-------------------------

<?php

session_start(); 

session_destroy(); 

echo "Je bent nu uitgelogged. Je kan op ieder gewenst moment weer inloggen."; 

?>[/code]