PHP-Projet_DVP/admin_xpath.php at master · notfound-404/PHP-Projet_DVP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
<?php
     // Reporte toutes les erreurs PHP
	error_reporting(-1);
	include('menu.html');
	//session_start();

	$header = "<html><head><title>Projet tuteuré XPATH injection</title></head><body><div>";
	$footer = "</div></body></html>";
	if(isset($_POST['username']) && isset($_POST['password']) && !empty($_POST['username']) && !empty($_POST['password'])){
		$xml = simplexml_load_file('xpath_username.xml');
		$xpath = "//user[username='" . $_POST['username'] . "' and password='" . $_POST['password'] . "']";

		$element = $xml->xpath($xpath);
		$user = $element[0]->username;
		if( count($element) > 1 ){
			echo $header;
			echo "<h1>User:".$user.", vous etes authentifie</h1>";
			echo $footer;
		} else {
			echo $header;
			echo "<h1>Authentification impossible. Username/password incorrect !</h1><br />";
?>
<form action="" method="POST">
	<label for="username">Username</label>
	<input type="text" id="username" name="username" />
	<br />
	<label for="password">Password</label>
	<input type="password" id="password" name="password" />
	<br />
	<input type="submit" value="Login" />
</form>
<?php
		echo $footer;
		}
	}else{
		echo $header;
?>
			<form action="" method="POST">
				<label for="username">Username</label>
				<input type="text" id="username" name="username" />
				<br />
				<label for="password">Password</label>
				<input type="password" id="password" name="password" />
				<br />
				<input type="submit" value="Login" />
			</form>
<?php
		echo $footer;
	}
?>