<?php
header( "Cache-Control: no-cache, must-revalidate" );
header( "Pragma: no-cache" );

function parseInput($input)
{
	$input = str_replace("<", "", $input);
	$input = str_replace(">", "", $input);
	$input = str_replace("'", "\'", $input);
	$input = str_replace("\"", "", $input);
	$input = str_replace("--", "", $input);
	$input = str_replace("<", "", $input);
	return $input;
}

header("Cache-Control: no-cache, must-revalidate");

// Connects to your Database
$dbhost = 'db.washingtonyachtclub.org';
$dbuser = 'wyc';
$dbpass = 'WYC#Sail!Pass';
$database = 'production';

$conn = mysql_connect($dbhost, $dbuser, $dbpass);
@mysql_select_db($database) or die( "Unable to select database");


//Checks if there is a login cookie
if(isset($_COOKIE['ID_wycnumber']))
{
	$wycnumber = $_COOKIE['ID_wycnumber'];
	$pass = $_COOKIE['Key_site'];
	$query = "SELECT * FROM WYCDatabase WHERE wycnumber = '".$wycnumber."' and password = PASSWORD('".$pass."')";
	$check = mysql_query($query)or die(mysql_error());
	$check2 = mysql_num_rows($check);
	if ($check2 != 0)
	{
		header("Location: cal.php");
	}
}

//if the login form is submitted
if (isset($_POST['submit']) | isset($_REQUEST['guest']))
{
	$proceed=0;
	$is_guest=0;
	// makes sure they filled it in
	if((!$_POST['wycnumber'] | !$_POST['password']) && !isset($_REQUEST['guest']))
	{
		die('Whoops, you missed a field. Go back and try again!<br/><br/><input type="button" value="Go Back" onClick="history.back()"/>');
	}
	else if(isset($_REQUEST['guest']))
	{
		$proceed=1;
		$is_guest=1;
	}
	else
	{
		// checks it against the database
		$query = "SELECT * FROM WYCDatabase WHERE wycnumber = '".parseInput($_POST['wycnumber'])."' and password = PASSWORD('".parseInput($_POST['password'])."')";
		$check = mysql_query($query)or die(mysql_error());
		//echo $query;
		//Gives error if user dosent exist
		$check2 = mysql_num_rows($check);

		if ($check2 == 0)
			die('Oh dear, you entered an incorrect wycnumber/password. Go back and try again!<br/><br/><input type="button" value="Go Back" onClick="history.back()"/>');
		$proceed=1;
	}

	if($proceed)
	{
		// if login is ok then we add a cookie
		$hour = time() + 3600;
		$u = "guest";
		$p = "gpass";
		if(!$is_guest)
		{
			//its good to call parseInput on this data again, just so we know we are dealing with the same data we authenticated
			$u = parseInput($_POST['wycnumber']);
			$p = parseInput($_POST['password']);
		}

		setcookie(ID_wycnumber, $u, $hour);
		setcookie(Key_site, $p, $hour);
		//then redirect them to the calendar page
		header("Location: cal.php");

	}
}
else
{


// if they are not logged in then show the login page as normal
?>
<html>
<head>
	<title>Washington Yacht Club Calendar</title>
	<link rel="stylesheet" type="text/css" href="css/wyc.css">
</head>
<body>
	<table>
		<tr>
		<td style="vertical-align:top; text-align:left; width:150px">
			<a href="http://www.washingtonyachtclub.com"><img src="images/burgee_purple.gif" alt="burgee_purple" /></a>
		</td>
		<td style="vertical-align:top">
			<span style="font-size:30">Washington Yacht Club</span>
			&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br />
			<span style="font-size:18">Keelboat availability</span>
			<br />
			<span style="font-size:9pt">
				Use this system to check boat availability at the <a target="_blank" href="http://www.washingtonyachtclub.org">Washington Yacht Club</a>.
			</span>
		</td>
		</tr>
	</table>
	<div style="margin-left:160px">
	<br /><br />
	<form name="form1" action="<?php echo $_SERVER['PHP_SELF']?>" method="post">
		<table border="0">
		<tr>
			<td colspan=2><h1>Login</h1></td>
		</tr>
		<tr>
			<td>WYC Number:</td>
			<td>
				<input type="text" name="wycnumber" maxlength="20">
			</td>
		</tr>
		<tr>
			<td>Password:</td>
			<td>
				<input type="password" name="password" maxlength="50">
			</td>
		</tr>
		<tr>
			<td colspan="2" align="right">
				<input type="submit" name="submit" value="Login">
			</td>
		</tr>
		</table>
		<span style="font-size:10pt">
		<br />
		<br />
		<br/>
		<a target="_blank" href="OKBRS.html">Online Usage Instructions</a>. This link provides a walk through of viewing reservations and making your own.
		<br/>
		<a target="_blank" href="http://www.washingtonyachtclub.org/wycdb/db.cgi?pg=NeedPW">Get a new password</a>. Use this if you don't have a password, or forgot it and need it reset.
		<br/>
		<a target="_blank" href="http://www.washingtonyachtclub.org/wycdb/">Manage your account settings</a>. Change phone number, address, and password information.
		<br/>
		<br/>
		<a href="login.php?guest=1">Login as a guest</a>. Note guests cannot reserve or have access to member information.
		</span>
	</form>
	</div>
	<div style="font-size:8pt; color:grey; text-align:center; margin-top:200px">
		Created by Edward Marsh. edm3 x cs y washington y edu (where x = AT and y = DOT)<br />
		Washington Yacht Club &copy; 2007
	</div>
</body>
</html>
<?php
}

?>
