Javascript-Quelltext

function login(user, pass) {
		
		
		
		var email = user;
		var pw = hex_md5(pass); // pw mit md5 hashen
		
		var req = null;
				
		try {
			req = new XMLHttpRequest();
		}
		catch(ms) {
			try {
				req = new ActiveXObject("Msxml2.XMLHTTP");	
			}
			catch(nonms) {
				try {
					req = new ActiveXObject("Microsoft.XMLHTTP");
				}
				catch(failed) {
					req = null;	
				}
			}
		
		}
			 	
		if(req == null) {
			alert("error");
		}
				
		
		req.open("POST", 'http://localhost/login.php?do=login', true);
				
		req.onreadystatechange = function() {
			switch(req.readyState) {
						
				case 4:
					if(req.status != 200) {
						alert("req.status: " + req.status);	
					}
					else {
						alert("req.responsetext: " + req.responseText);
					}
					break;
				default:
					return false;
				break;
						
			}
		};
				
		req.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
			
		
		req.send("username=" + email + "&userpw=" + pw); //"
		
	} // login [end]

HTML

<form action="#" onsubmit="login(document.getElementsByName('email').item(0).value, document.getElementsByName('pw').item(0).value);" method="post">
        	<label for="email">eMail:</label><input type="text" class="textfield" name="email" /><br />
            <label for="pw">Passwort:</label><input type="password" class="passwordfield" name="pw" /><br />
            <input type="submit" name="submitbutton" value="Login" id="submit" />
</form>

PHP-Quelltext

// session
    session_start();

    // includes
    include('connect.php');
    
    
    if(!defined(DIRECTLY))
        die('Access denied');

    
    
    switch($_GET['do']) {
        /*** login ***/
        case "login":
            
            $username = mysql_real_escape_string($_REQUEST['username']);
            $userpw = mysql_real_escape_string($_REQUEST['userpw']); // 
            
            $query = mysql_query("SELECT * FROM login WHERE username = '{$username}' AND pw = '{$userpw}'");
            while($row = mysql_fetch_assoc($query)) {
                if($username == $row['username'] && $userpw == $row['userpw']) {
                
                        
                    // sessions setzen
                    
                    $_SESSION['isLogin'] = true;
                    

                    
                }
                else {
                    if($_SESSION['isLogin'] == true) {
                        echo('you are already logged in');
                    }
                    else {
                        echo('incorrect password or username <br /> try again');
                    }
                }
            }
                
    
        break;
        /*** logout ***/
        case "logout":
            session_unset();
            session_destroy();
            header("Location: index.php");
        break;
    }

PHP-Quelltext

$username = mysql_real_escape_string($_REQUEST['username']);
            $userpw = mysql_real_escape_string($_REQUEST['userpw']); // 
            
            
            
            $query = mysql_query("SELECT * FROM login WHERE email = '{$username}' AND pw = '{$userpw}'");
            
            $row = mysql_num_rows($query);
            
            if($row < 1) {
                

                    
                    $_SESSION['isLogin'] = true;
                    
                
            }
            elseif($row > 0) {
                echo('incorrect password or username <br /> try again');

            }

Javascript-Quelltext

var request = false;
function login(user, pass) {
var email = user;
		var pw = hex_md5(pass); // diese function ist in einer externen js datei enthalten
		setRequest(email, pw);
}
function setRequest(email, pw) {
			
			if(window.XMLHttpRequest) {
				request = new XMLHttpRequest();
			}
			else if(window.ActiveXObject) {
				
				try {
					request = new ActiveXObject("Msxml2.XMLHTTP");
				}
				catch(ex) {
					
					try {
						request = new ActiveXObject("Microsoft.XMLHTTP");			
					}
					catch(e) { 
						alert(e); 
					}
				}
			} // else if [end]
			
			if(!request) {
				alert("Fehler beim XMLHTTP-Instanz erzeugen");
			}
			else {
				
				alert("asdasd");
				
				var url = "http://127.0.0.1/codesnippetmanageronline/login.php?email=" + email + "&pw=" + pw; //?;
				//alert(email + pw);
				request.open('GET', url, true);
					
				request.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');

				request.send(null);
				
				request.onreadystatechange = interpretRequest;
				
			} // if !request [end]
			
			
		} // setRequest [end]
		
		function interpretRequest() {
			alert("interpretRequest()");
			switch(request.readyState) {
			
				case 4:
					if(request.status != 200) {
						alert("Fehler: " + request.status);
					}
					else {
						var xml = request.responseXML;
						var login = xml.getElementsByTagName('eingeloggt')[0].firstChild.nodeValue;
					}
				
					alert(login);
				
				break;
			}
			
			
		} // interpretRequest [end]

PHP-Quelltext

session_start();
    
    include('connect.php');
    
    if(isset($_REQUEST['email']) && isset($_REQUEST['pw'])) {
        
        header('Content-Type: text/xml; charset=utf-8');
        
        echo("<?xml version="1.0\" encoding=\"utf-8\"?>\n");
        echo("<login>\n");
        
        $email = mysql_real_escape_string($_REQUEST['email']);
        $pw = $_REQUEST['pw']; // wird schon md5 gehahst übertragen
        
        $query = mysql_query("SELECT * FROM login WHERE email = '".$email."' AND pw = '".$pw."'");
        $rows = mysql_num_rows($query);
            
        if($rows == 1) {
        
            
            echo("\t<eingeloggt>true</eingeloggt>");
            $_SESSION['isLogin'] = true;
            
        }
        elseif($rows == 0) {
            echo("\t<eingeloggt>false</eingeloggt>");
            $_SESSION['isLogin'] = false;
        }
    
    
        echo("</login>");
    }
    else {
        echo('access denied');    
    }