From be4b0a33ac4310a212ccf4b0ba7bc718909195fa Mon Sep 17 00:00:00 2001
From: Jack-Benny Persson <jack-benny@cyberinfo.se>
Date: Thu, 22 May 2014 08:41:34 +0200
Subject: [PATCH] Replaced 'break' with 'exit' and inserted 'isset' on
 cookie-check

---
 includes/login.inc | 38 +++++++++++++++++++++++---------------
 1 file changed, 23 insertions(+), 15 deletions(-)

diff --git a/includes/login.inc b/includes/login.inc
index c39570b..c6a20d5 100644
--- a/includes/login.inc
+++ b/includes/login.inc
@@ -1,37 +1,45 @@
 <?php
 
 # Check if the user is logged in and authenticated
-if ( $_COOKIE['session'] ) { // If yes, continue loading page as normal
+if (isset( $_COOKIE['session'] ))
+{ 
+    # If yes, continue loading page as normal
+    # If not logged in, check if this is an attempt to login...
+} 
+else if (isset($_POST['do']) == "authenticate") 
+{
 
-# If not logged in, check if this is an attempt to login...
-} else if ($_POST['do'] == "authenticate") {
+    # If we're trying to login...
 
-# If we're trying to login...
-
-# Attempt login
+    # Attempt login
 	require "dbconnect.php";
  	$sql = "SELECT id,username FROM blog_users WHERE username='$_POST[username]' and password=PASSWORD('$_POST[password]')";
 	$result = mysql_query($sql) or die (mysql_error());
 
-#	echo "Results: " . mysql_num_rows($result); // Debugging line
+    #	echo "Results: " . mysql_num_rows($result); // Debugging line
 
-	if (mysql_num_rows($result) === 1) { // If user found and password matches
+	if (mysql_num_rows($result) === 1) 
+    { // If user found and password matches
 		unset($_POST['do']); // No longer authenticating
 
-# Create cookie and set it
+    # Create cookie and set it
 		$_COOKIE['session'] = '1'; 
 		setcookie('session',$_COOKIE['session']);
 
-	} else { //  If user not found or password doesn't match
+	} 
+    else 
+    { //  If user not found or password doesn't match
 		unset($_POST['do']);
-# Attempt login again. This should be limited in the future.
+        # Attempt login again. This should be limited in the future.
 		echo "Login failed. Please try again.";
 		include("login_form.inc");
-		break;
-	}
-} else { // If this is the first visit to the user/admin area...
+		exit;
+   }
+} 
+else 
+{ // If this is the first visit to the user/admin area...
         echo "Please login:";
         include "login_form.inc";
-        break;
+        exit;
 }
 ?>