better-staridc-MNBT
1<?php
2if($egn=='login') {
3 if(isset($_POST['user']) && isset($_POST['pass'])) {
4 $user=daddslashes($_POST['user']);
5 $pass=daddslashes($_POST['pass']);
6 $code=daddslashes($_POST['code']);
7 if(strpos($user,'"') || strpos($user,"'") || strpos($user,',') || strpos($user,'/') || strpos($user,"\\"))exit('{"code":"账号不能包含危险字符！"}');
8 $wedsv=$DB->get_row_prepare("SELECT * FROM MN_zj WHERE user=? limit 1", [$user]);
9 if ($conf['yzme']!='false' && $code != $_SESSION['authcode']) {
10 unset($_SESSION['authcode']);
11 @header('Content-Type: text/html; charset=UTF-8');
12 exit('{"code":"验证码错误！"}');
13 } elseif($user==$wedsv['user'] && $pass==$wedsv['pass']) {
14 unset($_SESSION['authcode']);
15 $session=md5($user.$pass.$password_hash);
16 $token=authcode("{$user}\t{$session}", 'ENCODE', SYS_KEY);
17 mnbt_rotate_login_session();
18 mnbt_set_auth_cookie("user_token", $token, time() + 604800);
19 @header('Content-Type: text/html; charset=UTF-8');
20 json_exit('登陆成功');
21 } else {
22 @header('Content-Type: text/html; charset=UTF-8');
23 exit('{"code":"用户不存在或密码错误！"}');
24 }
25 } elseif(isset($_POST['logout'])) {
26 mnbt_set_auth_cookie("user_token", "", time() - 604800);
27 @header('Content-Type: text/html; charset=UTF-8');
28 exit('{"code":"您已成功注销本次登陆！"}');
29 }
30 return;
31}