<?

php
ob_start();
include "config/koneksi.php";
include "config/fungsi_lain.php";
function anti_injection($data){
$filter =
mysql_real_escape_string(stripslashes(strip_tags(htmlspecialchars($data,ENT_QUOTES)
)));
return $filter;
}

$username = anti_injection($_POST['username']);
$pass = anti_injection(password($_POST['password']));

if (isset($_POST[login])) {
// pastikan username dan password adalah berupa huruf atau angka.
if (!ctype_alnum($username) OR !ctype_alnum($pass)){
echo "Sekarang loginnya tidak bisa di injeksi lho.";
}
else{
$login=mysql_query("SELECT * FROM users WHERE username='$username' AND
password='$pass' AND blokir='N'");
$ketemu=mysql_num_rows($login);
$r=mysql_fetch_array($login);

// Apabila username dan password ditemukan

if ($ketemu > 0){
session_start();
include "login/timeout.php";

$_SESSION[namauser] = $r[username];
$_SESSION[namalengkap] = $r[nama_lengkap];
$_SESSION[passuser] = $r[password];
$_SESSION[leveluser] = $r[level];

// session timeout
$_SESSION[login] = 1;
timer();

$sid_lama = session_id();

session_regenerate_id();

$sid_baru = session_id();

mysql_query("UPDATE users SET id_session='$sid_baru' WHERE

username='$username'");
if(isset($_SESSION[url_buku])) {
header('location:'.$_SESSION[url_buku]);
} else {
header('location:index.php');
}
}
else{
echo "<script language='javascript'>alert('Username atau Password
Salah')</script>";
header('refresh:0,masuk/index.php');
}
}
}
elseif (isset($_POST[register])) {
if($_POST[password]==$_POST[ulangpassword]) {
$cek=mysql_query("SELECT * FROM users WHERE
username='$_POST[username]'");
$dapat=mysql_num_rows($cek);
if($dapat > 0) {
echo "<script language='javascript'>alert('Username Sudah
terdaftar')</script>";
header('refresh:0,masuk/register.php');
}
else {
$pass = password($_POST[password]);
$session = md5($_POST[username]);
$proses = mysql_query("INSERT INTO users(username,
password,
nama_lengkap,
email,
no_telp,
level,
id_session)
VALUES('$_POST[username]',
'$pass',
'$_POST[nama]',
'$_POST[email]',
'$_POST[notlp]',
'pembaca',
'$session')");
if($proses) {
session_start();
include "login/timeout.php";

$_SESSION[namauser] = $_POST[username];
$_SESSION[namalengkap] = $_POST[nama];
$_SESSION[passuser] = $pass;
$_SESSION[leveluser] = "pembaca";

// session timeout
$_SESSION[login] = 1;
timer();

$sid_lama = session_id();

session_regenerate_id();

$sid_baru = session_id();

mysql_query("UPDATE users SET id_session='$sid_baru' WHERE

username='".$_SESSION[namauser]."'");
if(isset($_SESSION[url_buku])) {
header('location:'.$_SESSION[url_buku]);
} else {
header('location:index.php');
}
}
}
} else {
echo "<script language='javascript'>alert('Password yang dimasukan
tidak sama')</script>";
 header('refresh:0,masuk/register.php');
}
}
else {
header('refresh:0,index.php');
}
?>