<?php
//beskydt mod hack
function clean($str) {
$str = @trim($str);
if(get_magic_quotes_gpc()) {
$str = stripslashes($str);
}
return mysql_real_escape_string($str);
}
$host="********";
$username="********";
$password="********";
$db_name="********";
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
mysql_query("SET NAMES utf8");
mysql_query("SET character_set_results='utf8′");
mysql_query("UPDATE `users` SET
`firstname` = '".clean($_POST['$_POST["firstname"]'])."',
`lastname` = '".clean($_POST["lastname"])."'
WHERE `users`.`id` =".clean($_GET['id'])."") or die(mysql_error());
$fejl = false;
if(!empty($_POST['newpassword']) || !empty($_POST['repeatnewpassword'])){
if(empty($_POST['newpassword'])){
echo "Udfyld: newpassword";
$fejl = true;
}
if(empty($_POST['repeatnewpassword'])){
echo "Udfyld: repeatnewpassword";
$fejl = true;
}
if(!$fejl){
if($_POST['repeatnewpassword'] === $_POST['newpassword']){
mysql_query("UPDATE `users` SET
`password` = '".clean($_POST['$_POST["newpassword"]'])."'
WHERE `users`.`id` =".clean($_GET['id'])."") or die(mysql_error());
}else{
echo "de to kode ord er ikke ens!";
}
}
}
mysql_close();
?>
sådan ville jeg gøre det
(fejl kan forkomme da jeg har skrevet den her i eksperten)
