session_start(); $error_msg = false; if( isset( $_REQUEST['submit'] ) ) { // Let's assume that only a validated form will get here, but that only means that all fields are present in an acceptible form, and the user has agreed to our T&C. // We still have to validate the credentials. require_once( 'config.inc' ); $con = @mysql_connect( $dbhost, $dbuser, $dbpass ) or die( "An internal error occured connecting to the credentials system. Please report the following message to this site's administrator: ".mysql_error() ); $db = @mysql_select_db( $dbname, $con ) or die( "An internal error occured while logging you in. Please report the following message to this site's administrator: ".mysql_error() ); extract( $_POST ); $username = mysql_real_escape_string( $username ); $password = mysql_real_escape_string( $password ); // die( "DEBUGGING ONLY - username = $username, password = $password" ); // Validate the credentials and re-direct to the customer's sub-domain. $sql = "SELECT u.*, c.domain FROM user AS u LEFT JOIN customer AS c USING( customer_id ) WHERE u.email = '$username' and password = PASSWORD( '$password' ) LIMIT 0, 1"; if( ( $result = mysql_query( $sql ) ) && mysql_num_rows( $result ) > 0 ) { // print_r( mysql_fetch_assoc( $result ) ); extract( mysql_fetch_assoc( $result ) ); // Note that we can include both username and password in the URL because the login process reads the data, but does // not expose it. $url = "https://$domain/login/auto/".urlencode( $username ); //.'/'.urlencode( $password ); // echo "redirecting to $uel"; header( "Location: $url" ); exit; } else $error_msg = true; } ?>