[Anfrage] Login Script

<?php
if(isset($_POST['account']) AND isset($_POST['alt_password']) AND isset($_POST['neu_password'])) {
$alt_pw = $_POST['alt_password']; //wie wird das pw verschlüsselt? ka^^
$pw_check = mssql_fetch_array(mssql_query("SELECT account FROM ACCOUNT_TBL WHERE password = '".mssql_real_escape_string($alt_pw)."')) AND account = '".mssql_real_escape_string($_POST['account'])."'))


If(isset($pw_check['account'])) {
mssql_query("UPDATE ACCOUNT_TBL SET password = '".mssql_real_escape_string($_POST['neu_password'])."' WHERE password = '".mssql_real_escape_string($alt_pw)."')) AND account = '".mssql_real_escape_string($_POST['account'])."'")
echo "pw geändert";
} else {
echo "pw falsch";
}


}
?>
<html>
<form method="post">
Account: <input type="text" name="account"><br>
Aktuelles Password: <input type="password" name="alt_password"><br>
Neues Password: <input type="password" name="neu_password"><br>
</form>
<html>

<?php session_start(); ?>
<?php
if (!defined("PANEL_PAGE"))
{
    die("<a href='panel.php'>OMFGWTFBBQ?!!</a>");
}
if (isset($_POST[Change]))
{
    $can_change = 1;
    $change[succeed] = 0;


    $old_pw = $_POST[old_pw];
    $new_pw1 = $_POST[new_pw1];
    $new_pw2 = $_POST[new_pw2];


    $match_old = preg_match("=^[a-zA-Z0-9]+$=i",$old_pw);
    $match_new = preg_match("=^[a-zA-Z0-9]+$=i",$new_pw1);


    if ($match_old == 0 || $match_new == 0)
    {
        $can_change = 0;
        $change[false_char] = 1;
    }
    if ($new_pw1 != $new_pw2)
    {
        $can_change = 0;
        $change[pw_not_match] = 1;
    }
    if (strlen($new_pw1) < 5 || strlen($new_pw1) > 16)
    {
        $can_change = 0;
        $change[pw_false_length] = 1;
    }
    if (md5($_CONFIG[hash].$old_pw) != $_SESSION[pass])
    {
        $can_change = 0;
        $change[false_pw] = 1;
    }
    if ($can_change == 1)
    {
        $pw_hash = md5($_CONFIG[hash].$new_pw1);
        mssql_connect($MSSQL_NAME, $MSSQL_USER, $MSSQL_PW)
            or die("Keine Verbindung zu MSSQL");


        mssql_select_db("ACCOUNT_DBF")
            or die("Konnte DB nicht w&auml;hlem");


        mysql_connect($MYSQL_SERVER, $MYSQL_USER, $MYSQL_PW)
            or die("Keine Verbindung zu MySQL");


        mysql_select_db("control")
            or die("Konnte DB nicht w&auml;hlen");


        mssql_query("UPDATE ACCOUNT_TBL SET password = '".$pw_hash."' WHERE account = '".$_SESSION[user]."'")
            or die("ERROR");


        mysql_query("UPDATE accounts SET Password = '".$pw_hash."' WHERE Name = '".$_SESSION[user]."'")
            or die("ERROR");
        $result = mysql_query("SELECT * FROM pw_changes WHERE Name='".$_SESSION[user]."'");
        if (mysql_num_rows($result) == 0)
        {
            mysql_query("INSERT INTO pw_changes (Name, old_pw, new_pw, change_date, times_changed) VALUES ('".$_SESSION[user]."', '".$_SESSION[pass]."', '".$_SESSION[pass]."', '".date("Y-m-d H:i:s")."', 0)");
        }
        mysql_query("UPDATE pw_changes SET old_pw='".$_SESSION[pass]."'");
        mysql_query("UPDATE pw_changes SET new_pw='".$pw_hash."'");
        mysql_query("UPDATE pw_changes SET times_changed=(times_changed + 1)");
        $_SESSION[pass] = $pw_hash;
        $change[succeed] = 1;
    }
}
?>
<center>
<?php
if (isset($_POST[Change]))
{
    if ($change[false_char] == 1)
        echo "<font color='red'>Unerlaubte Zeichen enthalten</font><br />";
    if ($change[pw_not_match] == 1)
        echo "<font color='red'>Die beiden Passw&ouml;rter stimmen nicht &uuml;berein</font><br />";
    if ($change[pw_false_length] == 1)
        echo "<font color='red'>Das Passwort muss zwischen 5 und 16 Zeichen haben</font><br />";
    if ($change[false_pw] == 1)
        echo "<font color='red'>Falsches Passwort</font><br />";
    if ($change[succeed] == 1)
        echo "<font color='green'>Passwort erfolgreich ge&auml;ndert</font>";
}
?>
<?php
if ($change[succeed] != 1)
    echo '<h1>Passwort &auml;ndern</h1>
<form action="panel.php?p=pwchange" method="post">
<table>
<tr>
<td>Altes Passwort:</td>
<td><input type="password" name="old_pw" /></td>
</tr><tr><br /></tr><tr>
<td>Neues Passwort:</td>
<td><input type="password" name="new_pw1" /></td>
</tr><tr>
<td>Passwort wiederholen:</td>
<td><input type="password" name="new_pw2" /></td>
</tr>
</table>
<input type="submit" value="Passwort &auml;ndern" name="Change" />
</form>
</center><br /><a href="panel.php">Zur&uuml;ck</a>';
else
    echo "<br /><a href='panel.php'>Zur&uuml;ck</a>";