<?php
// SESSION STARTING HERE
include("../../functions.php");
include("../../configuration.php");
include("../../dbhandle.php");
include("../../security.php");
include('../../../data/plugins/load.php');
session_start();
// GETTING IP
$uip = getIP();

// IF LOGGED IN PUBLISHER
if($loggedin == '1') {
echo"<script type='text/javascript'>window.location= 'p.Dashboard'</script>";
}
// IF LOGGED IN ADVERTISER
if($aloggedin == '1') {
echo"<script type='text/javascript'>window.location= 'p.Dashboard'</script>";
}

if ( isset( $_POST[ 'field' ] ) )
{
    try
    {
        // Run CSRF check, on POST data, in exception mode, for 10 minutes, in one-time mode.
        NoCSRF::check( 'csrf_token', $_POST, true, 60*10, false );
        // form parsing, DB inserts, etc.
        // ...
        $result = 'CSRF check passed. Form parsed.';
    }
    catch ( Exception $e )
    {
        // CSRF attack detected
        echo"<script type='text/javascript'>window.location= 'f.Home'</script>";
    }
}

if (isset($_POST['submit'])) {

$accounttype = $_POST['accounttype'];
$accounttype = AntiXSS::setEncoding($accounttype, "UTF-8");
$accounttype = str_replace('"','',$accounttype);
$accounttype = str_replace("'","",$accounttype);
$accounttype = str_replace(">","",$accounttype);
$accounttype = str_replace("<","",$accounttype);
$accounttype = str_replace("</","",$accounttype);
$accounttype = str_replace("&%","",$accounttype);
$accounttype = str_replace("script","",$accounttype);
$accounttype = str_replace("(","",$accounttype);
$accounttype = str_replace(")","",$accounttype);
$username = mysql_real_escape_string($_POST['login_username']);
$username = AntiXSS::setEncoding($username, "UTF-8");
$username = str_replace('"','',$username);
$username = str_replace("'","",$username);
$username = str_replace(">","",$username);
$username = str_replace("<","",$username);
$username = str_replace("</","",$username);
$username = str_replace("&%","",$username);
$username = str_replace("script","",$username);
$username = str_replace("(","",$username);
$username = str_replace(")","",$username);
$password = mysql_real_escape_string(md5($_POST['login_password']));
$password = AntiXSS::setEncoding($password, "UTF-8");
$password = str_replace('"','',$password);
$password = str_replace("'","",$password);
$password = str_replace(">","",$password);
$password = str_replace("<","",$password);
$password = str_replace("</","",$password);
$password = str_replace("&%","",$password);
$password = str_replace("script","",$password);
$password = str_replace("(","",$password);
$password = str_replace(")","",$password);
$username = AntiXSS::setEncoding($username, "UTF-8"); 
$password = AntiXSS::setEncoding($password, "UTF-8"); 

if($accounttype == 'pub') {
	$selecttype = mysql_query("SELECT * FROM Accounts_Classic_Publishers WHERE username='$username'");
	$pubrows = mysql_num_rows($selecttype);
	if($pubrows == '1') {
		$acctype = 'publisher';
	}
	// IF USERNAME AND PASSWORD WERE ENTERED 
	if ($username&&$password)
	{
	
	if($acctype == '') {
	// ACCOUNT WITH THIS USERNAME NOT FOUND
	 							?>
								<form action='f.Home' method='post' name='frm'>
									<input type='hidden' name='error' value='notexist'>
								</form>
								<script language="JavaScript">
									document.frm.submit();
								</script>
								<?php
	}
	}
}
if($accounttype == 'adv') {
	$selecttypeadv = mysql_query("SELECT * FROM Accounts_Classic_Advertisers WHERE username='$username'");
	$advrows = mysql_num_rows($selecttypeadv);
	if($advrows == '1') {
		$acctype = 'advertiser';
	}
	// IF USERNAME AND PASSWORD WERE ENTERED 
	if ($username&&$password)
	{
	
	if($acctype == '') {
	// ACCOUNT WITH THIS USERNAME NOT FOUND
	 							?>
								<form action='f.Home' method='post' name='frm'>
									<input type='hidden' name='error' value='notexist'>
								</form>
								<script language="JavaScript">
									document.frm.submit();
								</script>
								<?php
	}
	}
}

if($acctype == 'publisher') {          
		$username = AntiXSS::setEncoding($username, "UTF-8"); 
		$hash3 = "SELECT `hash` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
		$hash2 = mysql_query($hash3) or die($hash3."<br/><br/>".mysql_error());
		$hash = mysql_result($hash2, 0);
		$query = mysql_query("SELECT * FROM Accounts_Classic_Publishers WHERE username='$username'");
		$numrows = mysql_num_rows($query);

			if ($numrows!=0)
			{
				 while ($row = mysql_fetch_assoc($query))
				  {
					     $dbusername = $row['username'];
					     $dbpassword = $row['password'];
				   }

					  // CHECK TO SEE IF THEY MATCH!
				  if ($username==$dbusername&&$password==$dbpassword)
				  {
						if ($hash)
						{
							?>
								<form action='f.Home' method='post' name='frm'>
									<input type='hidden' name='error' value='activate'>
								</form>
								<script language="JavaScript">
									document.frm.submit();
								</script>
								<?php
						}else{
									$_SESSION['username'] = $username;
                           $_SESSION['password'] = $password;
                           $_SESSION['acctype'] = 0;
                           	//LAST1IP >> LAST2IP
                           	$l1p = "SELECT `last1ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l1p = mysql_query($l1p) or die($l1p."<br/><br/>".mysql_error());
										$l1p = mysql_result($l1p, 0);
										//LAST2IP >> LAST3IP
                           	$l2p = "SELECT `last2ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l2p = mysql_query($l2p) or die($l2p."<br/><br/>".mysql_error());
										$l2p = mysql_result($l2p, 0);
										//LAST3IP >> LAST4IP
                           	$l3p = "SELECT `last3ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l3p = mysql_query($l3p) or die($l3p."<br/><br/>".mysql_error());
										$l3p = mysql_result($l3p, 0);
										//LAST4IP >> LAST5IP
                           	$l4p = "SELECT `last4ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l4p = mysql_query($l4p) or die($l4p."<br/><br/>".mysql_error());
										$l4p = mysql_result($l4p, 0);
										//LAST5IP >> LAST6IP
                           	$l5p = "SELECT `last5ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l5p = mysql_query($l5p) or die($l5p."<br/><br/>".mysql_error());
										$l5p = mysql_result($l5p, 0);
										//LAST6IP >> LAST7IP
                           	$l6p = "SELECT `last6ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l6p = mysql_query($l6p) or die($l6p."<br/><br/>".mysql_error());
										$l6p = mysql_result($l6p, 0);
                           	$updateip1 = mysql_query("UPDATE Accounts_Classic_Publishers SET last1ip='$uip', last2ip='$l1p', last3ip='$l2p', last4ip='$l3p', last5ip='$l4p', last6ip='$l5p', last7ip='$l6p' WHERE username='$username'"); 
                           	$updateip2 = mysql_query("UPDATE Accounts_Classic_Advertisers SET last1ip='$uip', last2ip='$l1p', last3ip='$l2p', last4ip='$l3p', last5ip='$l4p', last6ip='$l5p', last7ip='$l6p' WHERE username='$username'"); 
							//SUCCESSFULY LOGGED IN
							?>
							<form action='p.Dashboard' method='post' name='frm'>
							<input type='hidden' name='success' value='loggedin'>
							</form>
							<script language="JavaScript">
								document.frm.submit();
							</script>
							<?php
						}		
				  }
				  else  
				  // PASSWORD IS INCORECT
					  { 
					  			?>
								<form action='f.Home' method='post' name='frm'>
									<input type='hidden' name='error' value='notexist'>
								</form>
								<script language="JavaScript">
									document.frm.submit();
								</script>
								<?php
					  }
 
			}
			// USERNAME NOT FOUND
			else{
			  					?>
								<form action='f.Home' method='post' name='frm'>
									<input type='hidden' name='error' value='notexist'>
								</form>
								<script language="JavaScript">
									document.frm.submit();
								</script>
								<?php
			}

}
// ADVERTISER LOGGING
else if($acctype == 'advertiser') {
		$username = AntiXSS::setEncoding($username, "UTF-8"); 
		$hash3 = "SELECT `hash` FROM `Accounts_Classic_Advertisers` WHERE `username` = '$username'";
		$hash2 = mysql_query($hash3) or die($hash3."<br/><br/>".mysql_error());
		$hash = mysql_result($hash2, 0);
		$query = mysql_query("SELECT * FROM Accounts_Classic_Advertisers WHERE username='$username'");
		$numrows = mysql_num_rows($query);

			if ($numrows!=0)
			{
				while ($row = mysql_fetch_assoc($query))
				  {
					     $dbusername = $row['username'];
					     $dbpassword = $row['password'];
				   }

					  // check to see if they match!
				  if ($username==$dbusername&&$password==$dbpassword)
				  {
							if ($hash)
							{
								?>
								<form action='f.Home' method='post' name='frm'>
									<input type='hidden' name='error' value='activate'>
								</form>
								<script language="JavaScript">
									document.frm.submit();
								</script>
								<?php
							}else{
								$_SESSION['username']=$username;
								$_SESSION['password']=$password;
								$_SESSION['acctype'] = 1;
										//LAST1IP >> LAST2IP
                           	$l1p = "SELECT `last1ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l1p = mysql_query($l1p) or die($l1p."<br/><br/>".mysql_error());
										$l1p = mysql_result($l1p, 0);
										//LAST2IP >> LAST3IP
                           	$l2p = "SELECT `last2ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l2p = mysql_query($l2p) or die($l2p."<br/><br/>".mysql_error());
										$l2p = mysql_result($l2p, 0);
										//LAST3IP >> LAST4IP
                           	$l3p = "SELECT `last3ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l3p = mysql_query($l3p) or die($l3p."<br/><br/>".mysql_error());
										$l3p = mysql_result($l3p, 0);
										//LAST4IP >> LAST5IP
                           	$l4p = "SELECT `last4ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l4p = mysql_query($l4p) or die($l4p."<br/><br/>".mysql_error());
										$l4p = mysql_result($l4p, 0);
										//LAST5IP >> LAST6IP
                           	$l5p = "SELECT `last5ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l5p = mysql_query($l5p) or die($l5p."<br/><br/>".mysql_error());
										$l5p = mysql_result($l5p, 0);
										//LAST6IP >> LAST7IP
                           	$l6p = "SELECT `last6ip` FROM `Accounts_Classic_Publishers` WHERE `username` = '$username'";
										$l6p = mysql_query($l6p) or die($l6p."<br/><br/>".mysql_error());
										$l6p = mysql_result($l6p, 0);
                           	$updateip1 = mysql_query("UPDATE Accounts_Classic_Publishers SET last1ip='$uip', last2ip='$l1p', last3ip='$l2p', last4ip='$l3p', last5ip='$l4p', last6ip='$l5p', last7ip='$l6p' WHERE username='$username'");
                           	$updateip2 = mysql_query("UPDATE Accounts_Classic_Advertisers SET last1ip='$uip', last2ip='$l1p', last3ip='$l2p', last4ip='$l3p', last5ip='$l4p', last6ip='$l5p', last7ip='$l6p' WHERE username='$username'");
								// SUCCESSFULY LOGGED IN
								?>
								<form action='p.Dashboard' method='post' name='frm'>
									<input type='hidden' name='success' value='loggedin'>
								</form>
								<script language="JavaScript">
									document.frm.submit();
								</script>
								<?php
							}	
				  }
				  // PASSWORD IS INCORECT
				  else  
					  {
					  			?>
								<form action='f.Home' method='post' name='frm'>
									<input type='hidden' name='error' value='notexist'>
								</form>
								<script language="JavaScript">
									document.frm.submit();
								</script>
								<?php
					  }
					 }
			// USERNAME NOT FOUND
			else{
			  					?>
								<form action='f.Home' method='post' name='frm'>
									<input type='hidden' name='error' value='notexist'>
								</form>
								<script language="JavaScript">
									document.frm.submit();
								</script>
								<?php
			  }


}else{
	 							?>
								<form action='f.Home' method='post' name='frm'>
									<input type='hidden' name='error' value='fillall'>
								</form>
								<script language="JavaScript">
									document.frm.submit();
								</script>
								<?php
	 	}
}else{
	 							?>
								<form action='f.Home' method='post' name='frm'>
									<input type='hidden' name='error' value='fillall'>
								</form>
								<script language="JavaScript">
									document.frm.submit();
								</script>
								<?php
	 	}

?>