If a user enters a wrong password they get a blank page with this code:
<?
include('dbinfo.inc.php');
include('css.php');
include('functions.inc.php');
$username = $_POST['username'];
$password = $_POST['password'];
$password = crypt_md5($password, $key);
$q = mysql_query("SELECT * FROM customers WHERE username='$username' AND password='$password'") or die(mysql_error());
$qu = mysql_fetch_array($q);
$logins = $qu['logins'];
$r = mysql_num_rows($q) or die(mysql_error());
if($r != 1){
if (getenv("HTTP_X_FORWARDED_FOR")) {
$ip = getenv("HTTP_X_FORWARDED_FOR");
} else {
$ip = getenv("REMOTE_ADDR");
}
echo "Forbidden! Your IP: $ip and timestamp have been logged.";
$p = $_SERVER['REQUEST_URI'];
mysql_query("INSERT INTO error (ip, page) VALUES ('$ip', '$p')") or die(mysql_error());
} else {
if($logins == 1){
echo "Successful Login. $username <br>"; ?><a href="changepass.php?username=<?= $username ?>" onmouseover="window.status='Change Password' ; return true">This is your first login. Please change your password.</a>
<?
$logins++;
mysql_query("UPDATE customers SET logins='$logins'") or die(mysql_error());
} else {
echo "Successful Login, $username ";
$logins++;
mysql_query("UPDATE customers SET logins='$logins'") or die(mysql_error());
}}
?>
Could anyone explain why? I dont see any problems.
Thanks!