<?php
#security
#this one should be edited
//test cvs
//$allow_from='66.230.168.14';
$allow_from[]='127.0.0.1';
$allow_from[]='127.0.0.2';
$allow_from[]='64.59.71.224';
$enc_method = 'ENCRYPT'; //MD5|ENCRYPT|leave blank for unencrypted passwords
#comment the line above to allow access from all ips
#end securirty
######################### you should NOT edit any of these below######################
#  script expects $CMD variable to get the data
#  format of the DSN
# host|user|pass|database|tablename|username_field|password_field
#######################################################################################
$src = $_SERVER['REMOTE_ADDR'];
$ip_found = false;
foreach ($allow_from as $value)
{
    if ($src == $value) $ip_found = true;
}
if (!$ip_found)
{
   print "wrong ip $src";
   die;
}

$credentials[0];
header("Content-type: text/plain");
if (strstr($_POST[data], '\\\|')) $_POST[data] = str_replace('\\\|', '|', $_POST[data]);
$data_ar= explode(',',$_POST[data]);
$DSN=$data_ar[1];
$credentials=explode('|',$DSN);
$host=$credentials[0];
$user=$credentials[1];
$pass=$credentials[2];
$db=$credentials[3];
$tablename=$credentials[4];
$username_field=$credentials[5];
$password_field=$credentials[6];

$data = $_POST[data];

if(!mysql_connect($host,$user,$pass)) {echo "MySQL error 1";exit;}
if(!mysql_select_db($db)) {echo "MySQL error 2";exit;}

if($data_ar[0]=='CHECK' || $data_ar[0]=='DELETE')
{
    list($command, $ht_file, $user) = split(',',$data);
    if(strlen($user) < 3) die;
    if($data_ar[0]=='CHECK')
    {
        $sql = "select $password_field from $tablename where $username_field='$user'";
        $q = mysql_query($sql);
        $r = mysql_fetch_array($q);
        if($r[0])#found
        print "FOUND";
        else#not found
        print "NOT_FOUND";
    }
    else
    {#DEL OR CHECK
        $sql = "delete from $tablename where $username_field='$user'";
        $q = mysql_query($sql);
        if($q)
        print"DELETED $user";
        else
        print mysql_error();
    }#DEL OR CHECK
}
elseif($data_ar[0]=='ADD')
{
    list($command, $ht_file, $user, $password) = split(',',$data);
    if(strlen($user) < 3) die("Username too short\n");
    $sql = "delete from $tablename where $username_field='$user'";
    $q = mysql_query($sql) or die("$sql\n".mysql_error());
    $sql = "insert into $tablename ($username_field,$password_field) values('$user',$enc_method('$password'))";
    $q = mysql_query($sql) or die("$sql\n".mysql_error());
    print "ADDED";
}
elseif($data_ar[0]=='CHECK')
{
    list($command, $ht_file, $users_pwds) = split(' ',$data);
    $user_pwd_array = split(',',$users_pwds);
    for ($i=0;$i<count($user_pwd_array);$i++)
    {
        list($user,$password)=split(':',$user_pwd_array[$i]);
        $sql = "delete from $tablename where $username_field='$user'";
        $q = mysql_query($sql);
        $sql = "insert into $tablename ($username_field,$password_field) values('$user',$enc_method('$password'))";
        if($ql) print "$user ADDED\n";
        else print "$sql\n".mysql_error();
    }
}
else echo "Unknown command\n";
?>