<?php
/* PHP Link Directory Copyright 2011 Robert Rook */
// Validate user login and fetch account
// information.
// userhead.php

if(!isset($db)) { die("<b>Error</b><br>\nFile called incorrectly."); }

if(!isset($_COOKIE['username']) || !isset($_COOKIE['password'])) {
	header("Location: {$site_url}/login.php?subpage=error&error=nocookies");
	die();
}
if(strip_tags($_COOKIE['username'])!=$_COOKIE['username'] || addslashes($_COOKIE['username'])!=$_COOKIE['username'] || strip_tags($_COOKIE['password'])!=$_COOKIE['password'] || addslashes($_COOKIE['password'])!=$_COOKIE['password']) {
	header("Location: {$site_url}/login.php?subpage=error&error=badlogin");
	die();
}

// Try and fetch users account
$result = mysql_query("SELECT * FROM {$prefix}users WHERE username='{$_COOKIE['username']}'", $db);
if(!mysql_num_rows($result)) {
	header("Location: {$site_url}/login.php?subpage=error&error=badlogin");
	die();
}
$userinf = mysql_fetch_array($result);
if(md5($userinf['password'])!=$_COOKIE['password']) {
	header("Location: {$site_url}/login.php?subpage=error&error=badlogin");
	die();
}

// Check account status is "Active"
if($userinf['bstatus']!=1) {
	header("Location: {$site_url}/login.php?subpage=error&error=blocked");
	die();
}

// Check the current IP address is good
if($userinf['lip']!=$_SERVER['REMOTE_ADDR']) {
	header("Location: {$site_url}/login.php?subpage=error&error=badip");
	die();
}

// Check the email has been verified
if(!$userinf['bverified']) {
	header("Location: {$site_url}/login.php?subpage=error&error=unverified");
	die();
}
?>