diff --git a/account.php b/account.php
index 6587a04..4c855f9 100644
--- a/account.php
+++ b/account.php
@@ -6,12 +6,13 @@ error_reporting(E_ALL);
session_start();
-if (empty($_SESSION['user_id'])) {
+if (empty($_SESSION['user_id']))
+{
header('Location: login.php');
exit();
}
-$userId = (int) $_SESSION['user_id'];
+$userId = (int)$_SESSION['user_id'];
$servername = "localhost";
$port = 3306;
@@ -20,13 +21,15 @@ $password = "L9wUNZZ9Qkbt";
$db = "FSST";
$conn = mysqli_connect($servername, $username, $password, $db, $port);
-if (!$conn) {
+if (!$conn)
+{
http_response_code(500);
die("Datenbankfehler");
}
-$stmt = mysqli_prepare($conn, "SELECT userID, displayName FROM users WHERE userID = ? LIMIT 1");
-if (!$stmt) {
+$stmt = mysqli_prepare($conn, "SELECT userID, displayName, email FROM users WHERE userID = ? LIMIT 1");
+if (!$stmt)
+{
http_response_code(500);
die("Datenbankfehler");
}
@@ -35,12 +38,21 @@ mysqli_stmt_bind_param($stmt, "i", $userId);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
-$user = $result ? mysqli_fetch_assoc($result) : null;
+
+if ($result)
+{
+ $user = mysqli_fetch_assoc($result);
+}
+else
+{
+ $user = null;
+}
mysqli_stmt_close($stmt);
mysqli_close($conn);
-if (!$user) {
+if (!$user)
+{
session_unset();
session_destroy();
header('Location: login.php');
@@ -49,14 +61,17 @@ if (!$user) {
include 'header.php';
?>
+
diff --git a/login.php b/login.php
index 5ca62c0..51cf64f 100644
--- a/login.php
+++ b/login.php
@@ -15,7 +15,8 @@ $password = "L9wUNZZ9Qkbt";
$db = "FSST";
$conn = mysqli_connect($servername, $username, $password, $db, $port);
-if (!$conn) {
+if (!$conn)
+{
http_response_code(500);
die("Datenbankfehler");
}
@@ -24,40 +25,63 @@ if (!$conn) {
$loginError = null;
$loginInfo = null;
-if (isset($_GET['registered']) && $_GET['registered'] === '1') {
+if (isset($_GET['registered']) && $_GET['registered'] === '1')
+{
$loginInfo = 'Registrierung erfolgreich. Du kannst dich jetzt einloggen.';
}
-if ($_SERVER['REQUEST_METHOD'] === 'POST') {
- $uname = trim(isset($_POST['uname']) ? $_POST['uname'] : '');
- $pw = isset($_POST['pw']) ? $_POST['pw'] : '';
+if ($_SERVER['REQUEST_METHOD'] === 'POST')
+{
+ $uname = '';
+
+ if (isset($_POST['uname']))
+ {
+ $uname = trim($_POST['uname']);
+ }
+
+ $pw = isset($_POST['pw']) ? $_POST['pw'] : '';
// Basic Validierung
- if ($uname === '' || $pw === '') {
+ if ($uname === '' || $pw === '')
+ {
$loginError = "Bitte Username und Passwort eingeben.";
- } else {
+ }
+ else
+ {
// Login ist SELECT, mit Prepared Statement (sicher) und ?-Platzhalter
$stmt = mysqli_prepare(
- $conn,
- "SELECT userID, displayName, passwordHash FROM users WHERE displayName = ? LIMIT 1"
+ $conn,
+ "SELECT userID, displayName, passwordHash FROM users WHERE displayName = ? LIMIT 1"
);
- if (!$stmt) {
+ if (!$stmt)
+ {
$loginError = "Datenbankfehler.";
- } else {
+ }
+ else
+ {
mysqli_stmt_bind_param($stmt, "s", $uname);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
- $user = $result ? mysqli_fetch_assoc($result) : null;
+
+ $user = null;
+
+ if ($result)
+ {
+ $user = mysqli_fetch_assoc($result);
+ }
// Passwort prüfen: Eingabe gegen gespeicherten Hash (password_hash/password_verify)
- if ($user && password_verify($pw, $user['passwordHash'])) {
+ if ($user && password_verify($pw, $user['passwordHash']))
+ {
// Optional: Rehash, falls Algorithmus/Cost geändert wurde
- if (password_needs_rehash($user['passwordHash'], PASSWORD_DEFAULT)) {
+ if (password_needs_rehash($user['passwordHash'], PASSWORD_DEFAULT))
+ {
$newHash = password_hash($pw, PASSWORD_DEFAULT);
$upd = mysqli_prepare($conn, "UPDATE users SET passwordHash = ? WHERE userID = ?");
- if ($upd) {
+ if ($upd)
+ {
$userID = (int)$user['userID'];
mysqli_stmt_bind_param($upd, "si", $newHash, $userID);
mysqli_stmt_execute($upd);
@@ -65,7 +89,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
}
}
- $_SESSION['user_id'] = (int)$user['userID'];
+ $_SESSION['user_id'] = (int)$user['userID'];
$_SESSION['displayName'] = $user['displayName'];
mysqli_stmt_close($stmt);
@@ -93,11 +117,13 @@ include 'header.php';
-
+
-
+