WebInterface Login

SQL-Statement zur Erzeugung der Tabelle: 
 
  CREATE TABLE users
 (
   ID int(11) PRIMARY KEY auto_increment,
   Name varchar(30) NOT NULL default '',
   Passwort varchar(32) NOT NULL default '',
   Session varchar(65),
   EMail varchar(100) NOT NULL default '',
  UNIQUE KEY
   Name (Name),
   UNIQUE KEY EMail (EMail)
 )

<?php
 
class login{
 
private $id = NULL;
private $name = NULL;
private $passwort = NULL;
private $email = NULL;
private $session = NULL;
private $dbconnection = NULL;


public function __construct($sessionid){
$this->dbconnection = new DB_MySQL();


$this->session = $sessionid;


if (isset($_POST['login'])===true && 
            isset($_POST['username'])===true && 
            isset($_POST['userpass'])===true){


 $this->name = $_POST['username'];
 $this->passwort = $_POST['userpass'];
 $this->login();
 return true;
}


if (isset($_GET['logout'])===true && $_GET['logout']==='1'){
 $this->logout();
}
}


private  function login(){
$query = 'SELECT * 
   FROM users
  WHERE  
   Name     = \''. mysql_real_escape_string($this->name) .'\' AND
   Passwort = \''. mysql_real_escape_string(MD5($this->passwort)) .'\'
  LIMIT 1;';


$this->dbconnection->query(&$query);


if($this->dbconnection->count()!==1){
return false;
} else {
$row = $this->dbconnection->fetchRow();
$this->email = $row['EMail'];
$this->id    = $row['ID'];


$this->logout();


$query = 'UPDATE  
           users
          SET  
           Session = \''. mysql_real_escape_string($this->session) .'\' 
          WHERE 
           ID =  '. $this->id .' 
          LIMIT 1;';


$this->dbconnection->query(&$query);


return true;
}
}


public function logged_in(){
$query = 'SELECT * 
   FROM users
  WHERE  
   Session = \''. mysql_real_escape_string($this->session) .'\' 
  LIMIT 1;';


$this->dbconnection->query(&$query);


return ($this->dbconnection->count()!==1) ? false : true;
}


public function showLogin(){
echo <<<EOT
<form method="post" action="">
<fieldset style="width:300px;text-align:right;position:absolute; left:20%; top:20%;">
 <legend>Benutzeranmeldung</legend>
<br />
    <label for="textinput1">Benutzername</label>
    <input type="text" name="username">
    <br />
    <label>Passwort</label>
    <input type="password" name="userpass" id="textinput2">
    <br /><br />
  <button name="login" type="submit">Anmelden</button> 
 
</fieldset>
</form>


EOT;
}


public function showLogout($text='Logout'){
echo '<a href="?logout=1&sid=',$this->session,'">',$text,'</a>';
}
 


private function logout(){
$query = 'UPDATE  
   users
  SET  
   Session = NULL 
  WHERE 
   Session = \''. mysql_real_escape_string($this->session) .'\'
  LIMIT 1;';


$this->dbconnection->query(&$query);
}
}
 
?>

<?php
 
include_once 'class/session.php';
include_once 'class/database.php';
include_once 'class/login.php';
 
$mylogin = new login(session::getSID());
 
if($mylogin->logged_in()!==true){
$mylogin->showLogin();
exit();
} 
 
?>

<?php
 include_once 'logintemplate.php';
?>
<h2>Index Seite</h2>
Die geheime Index-Seite.<br />
<br />
<h3>Navigation</h3>
<ul>
<li><a href="index.php<?php session::showLink(true);?>">Startseite</a></li>
<li><a href="verwaltung.php<?php session::showLink(true);?>">Verwaltung</a></li>
<li><?php $mylogin->showLogout();?></li>
</ul>
 

 Inhalt der Seiten verwaltung.php:
 <?php
 include_once 'logintemplate.php';
?>
<h2>Verwaltung</h2>
Die geheime Verwaltung.<br />
<br />
<h3>Navigation</h3>
<ul>
<li><a href="index.php<?php session::showLink(true);?>">Startseite</a></li>
<li><a href="verwaltung.php<?php session::showLink(true);?>">Verwaltung</a></li>
<li><?php $mylogin->showLogout();?></li>
</ul>

<?php
 
class DB_MySQL {
  private $connection = NULL;
  private $result = NULL;
  private $counter=NULL;

  private $dbconfig = array(
'server' => 'localhost',
'user' => 'root',
'password' => '',
'database' => 'myPHP',
);

  public function __construct(){
$this->connection = mysql_connect($this->dbconfig['server'],
                                      $this->dbconfig['user'],
                                      $this->dbconfig['password'],
                                      TRUE);
  mysql_select_db($this->dbconfig['database'], $this->connection);
  }
 
  public function disconnect() {
    if (is_resource($this->connection===true))
        mysql_close($this->connection);
  }
 
  public function query($query) {
  $this->result=mysql_query($query,$this->connection);
  $this->counter=NULL;
  }

  public function fetchRow() {
  return mysql_fetch_assoc($this->result);
  }

 
  public function count() {
  if($this->counter===NULL && is_resource($this->result)===true) {
  $this->counter=mysql_num_rows($this->result);
  }
 
return $this->counter;
  }
}
 
?>