$_POST['username'] ); try { // Execute the query against the database $stmt = $db->prepare($query); $result = $stmt->execute($query_params); } catch(PDOException $ex) { // Note: On a production website, you should not output $ex->getMessage(). // It may provide an attacker with helpful information about your code. die("Failed to run query: " . $ex->getMessage()); } // This variable tells us whether the user has successfully logged in or not. // We initialize it to false, assuming they have not. // If we determine that they have entered the right details, then we switch it to true. $login_ok = false; // Retrieve the user data from the database. If $row is false, then the username // they entered is not registered. $row = $stmt->fetch(); if($row) { // Using the password submitted by the user and the salt stored in the database, // we now check to see whether the passwords match by hashing the submitted password // and comparing it to the hashed version already stored in the database. $check_password = hash('sha256', $_POST['password'] . $row['Salt']); for($round = 0; $round < 65536; $round++) { $check_password = hash('sha256', $check_password . $row['Salt']); } if($check_password === $row['Password']) { // If they do, then we flip this to true $login_ok = true; } } // If the user logged in successfully, then we send them to the private members-only page // Otherwise, we display a login failed message and show the login form again if($login_ok) { // Here I am preparing to store the $row array into the $_SESSION by // removing the salt and password values from it. Although $_SESSION is // stored on the server-side, there is no reason to store sensitive values // in it unless you have to. Thus, it is best practice to remove these // sensitive values first. unset($row['Salt']); unset($row['Password']); // This stores the user's data into the session at the index 'user'. // We will check this index on the private members-only page to determine whether // or not the user is logged in. We can also use it to retrieve // the user's details. $_SESSION['user'] = $row; // Redirect the user to the private members-only page. header("Location: private.html"); die("Redirecting to: private.html"); } else { $submitted_username = htmlentities($_POST['username'], ENT_QUOTES, 'UTF-8'); if( does_username_exist( $submitted_username ) == True ) // Tell the user they failed print("Login Failed."); else print("The username you provided does not exist."); } } ?> Areno Family Football Pool
 

Areno Family College Football Pool Login

 

Click here to reset your password.