php - Admin login to user accounts -
i have pretty simple login script expect , checks match in database between email , password combination. although wondering if there way edit script administrator use users email such:
user@hotmail.com
and master password or something:
master123
to access account on system? here current script:
<? session_start(); require_once("system/db.php"); if($_post['submit']){ $email_address = $conn->real_escape_string($_post['email_address']); $password = md5($_post['password']); $stay_logged_in = $_post['stay_logged_in']; if (empty($email_address) === true || empty($password) === true) { header('location: login.php?loginerror=3'); } else { $sql1 = "select * ap_users email_address = '{$email_address}' limit 1"; $result1 = $conn->query($sql1); if (!$result1->num_rows == 1) { header('location: login.php?loginerror=4'); } else { $sql2 = "select * ap_users email_address = '{$email_address}' , blocked='0' limit 1"; $result2 = $conn->query($sql2); if (!$result2->num_rows == 1) { header('location: login.php?loginerror=6'); } else { $sql = "select * ap_users email_address = '{$email_address}' , password = '{$password}' limit 1"; $result = $conn->query($sql); if (!$result->num_rows == 1) { header('location: login.php?loginerror=2'); } else { mysqli_query($conn, "update ap_users set last_login = now() email_address = '{$email_address}'"); if($stay_logged_in == 1){ setcookie("email_address", $email_address, time()+31556926 ,'/'); } else { setcookie("email_address", $email_address); } $length = 76; $randomstring = substr(str_shuffle("0123456789abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz"), 0, $length); $hash = md5($randomstring); mysqli_query($conn, "update ap_users set login_hash = '{$hash}' email_address = '{$email_address}'"); if($stay_logged_in == 1){ setcookie("hash", $randomstring, time()+31556926 ,'/'); } else { setcookie("hash", $randomstring); } $value = 'yes'; if($stay_logged_in == 1){ setcookie("login", $value, time()+31556926 ,'/'); } else { setcookie("login", $value); } header('location: check_gateway.php'); } } } } } ?> i have tried adding:
if($_post['password'] != 'master123'){ $sql = "select * ap_users email_address = '{$email_address}' , password = '{$password}' limit 1"; $result = $conn->query($sql); if (!$result->num_rows == 1) { header('location: login.php?loginerror=2'); } else { } else if($_post['password'] == 'master123'){ which didn't quite job? ideas ?
create master_passowrd column in user table query that.
select * user `email` = '$email' , (`password` = '$password' or `master_passowrd` = '$password')
Comments
Post a Comment