Viewing File: /home/cienp/public_html/portal/check.php

<?php

    require "includes/conecta.php";
    $nm_site = "CIEnP";

    $v_senh = $v_senha = $_POST[senha];
    $v_senh = md5($v_senh);
    $_POST[login] = str_replace("'", "", $_POST[login]);
    $_POST[login] = str_replace("UPDATE", "", $_POST[login]);
    $_POST[login] = str_replace("update", "", $_POST[login]);
    $_POST[login] = str_replace("DELETE", "", $_POST[login]);
    $_POST[login] = str_replace("delete", "", $_POST[login]);
    $_POST[login] = str_replace("INSERT", "", $_POST[login]);
    $_POST[login] = str_replace("insert", "", $_POST[login]);
    $_POST[login] = str_replace("SELECT", "", $_POST[login]);
    $_POST[login] = str_replace("select", "", $_POST[login]);
    $v_logn = $_POST[login];

    $dataatual = date("Y-m-d H-i-s");

    $sql  = "SELECT id_user, lg_user, pw_user ";
    $sql .= "FROM " . $pref_tabl . "user ";
    $sql .= "WHERE lg_user = '$v_logn' ";
    $sql .= "AND pw_user = '$v_senh' ";
    $sql .= "AND fl_atvo = 'S'";
    $res  = mysqli_query($conn, $sql) or die("Erro no SQL");
    if ($linha = mysqli_fetch_array($res)) {
        if (($v_logn == $linha[lg_user]) 
         && ($v_senh == $linha[pw_user])) {
            session_start();

            // if ($linha[id_user] == 1) {
            //     $linha[id_user] = 47;
            // }

            $_SESSION[admn_cien] = $linha[id_user];
            HEADER("Location:index1.php");

            $ip = $_SERVER["REMOTE_ADDR"];

            $sql3  = "SELECT id_log ";
            $sql3 .= "FROM " . $pref_tabl . "log_aces ";
            $sql3 .= "WHERE id_user = $linha[id_user] ";
            $sql3 .= "ORDER BY dt_aces";
            $res3  = mysqli_query($conn, $sql3);
            if (mysqli_num_rows($res3) < 4) {
                $sql2  = "INSERT INTO " . $pref_tabl . "log_aces ";
                $sql2 .= "(dt_aces, ip_aces, id_user) ";
                $sql2 .= "VALUES ('$dataatual', '$ip', '$linha[id_user]')";
                $res2  = mysqli_query($conn, $sql2);
            } else {
                $cont = 1;
                while ($linha3 = mysqli_fetch_array($res3)) {
                    if ($cont == 1) {
                        $sql4 = "UPDATE " . $pref_tabl . "log_aces ";
                        $sql4 .= "SET dt_aces = '$dataatual', ";
                        $sql4 .= "ip_aces = '$ip' ";
                        $sql4 .= "WHERE id_log = $linha3[id_log]";
                        $res4 = mysqli_query($conn, $sql4);
                    }
                    $cont++;
                }
            }
        } else {
            HEADER("Location:login.php?certo=N");
            require "includes/erro_logn.php";
        }   
    } else {
        HEADER("Location:login.php?certo=N");
        require "includes/erro_logn.php";
    }
?>