Go4Security/account.php at master · NHLStenden/Go4Security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
<!DOCTYPE html>
<html lang="en">
<?php
    include("login.php");
    include("includes/head.php");
    include("includes/basket.php");
    $form = '<form action="'.htmlspecialchars($_SERVER["PHP_SELF"]).'" method="POST">
            <p>Change your password:</p>
            <input type="password" name="pass" class="form">
            <input type="hidden" name="user" value="'. (isset($_SESSION["user"])? $_SESSION["user"]: "") .'">
            <span class="input-group-btn">
                <button class="btn btn-primary" type="submit">Change</button>
            </span>
            </form>';
    if($_SERVER["REQUEST_METHOD"] == "POST" && !empty($_POST['pass'])){
        try{
            $conn = setupDb($dbhost,$dbUpdateUsername,$dbUpdatePassword);
            $prep = $conn->prepare("UPDATE user SET pass=:p WHERE username=:un;");
            $prep -> bindParam(':p',hash("sha256",$_POST['pass']));
            $prep -> bindParam(':un',$_POST['user']);
            $prep->execute();
            $prep = null;$conn = null;
            header("location: index.php");
            exit;
        }
        catch(PDOException $e){
            //echo $e->getMessage(); debug
        }
    }
?>
<body>
    <div id="navb">
    <?php
        include("includes/topbar.php");
        include("includes/navbar.php");
    ?>
    </div>
    <div id="all">
        <div id="content">
            <div class="container">
            <?php
                if(!isset($_GET['action'])){
                    echo'
                    <div class="box">
                        <div class="box">
                            <a href="account.php?action=pwchange">Change password</a>
                        </div>
                        <div class="box">
                            <a href="account.php?action=basket">Basket</a>
                        </div>
                    </div>
                    ';
                }
                else if($_GET['action'] === "pwchange"){
                echo'
                <div class="box">
                    <h4>Account Information:</h4>
                    <p>'. (isset($_SESSION["user"])? "Name: ".$_SESSION["user"]: "Not logged in"). '</p>
                    <hr>
                    '. (isset($_SESSION["user"]) ? $form : "Please login to use this function.").'
                </div>';}
                else if($_GET['action'] === "basket"){
                echo '
                <div class="box">
                    <h4>Products in cart:</h4>
                        <table class="table">
                        <thead>
                            <tr>
                                <th colspan="2">Product</th>
                                <th style="width: 100px; text-align: center;">Amount</th>
                                <th style="width: 100px; text-align: center;">Price</th>
                                <th style="width: 100px; text-align: center;">Total</th>
                            </tr>
                        </thead>
                        <tbody>';
                        ReturnProductsInBasket();
			echo'
                        </tbody>
                        <tfoot>
                            <tr>
                                <th colspan="4">Total</th>
                                <th colspan="2" style="text-align: right;">'; TotalPriceOfCart(); echo '</th>
                            </tr>
                        </tfoot>
                    </table>
                </div>';}
                ?>
            </div>
        </div>
            <?php
                include("includes/footer.php");
                include("includes/copyright.php");
            ?>
    </div>
    <?php include("includes/scripts.php"); ?>
</body>
</html>