Function isLinked() As Dynamic
if Len(m.RegToken) > 0 then
' send RegToken to server for validation
http = NewHttp(m.UrlValidate)
http.AddParam("RegToken", m.RegToken)
rsp = http.Http.GetToString()
xml = CreateObject("roXMLElement")
print "GOT: " + rsp
print "Reason: " + http.Http.GetFailureReason()
if not xml.Parse(rsp) then
print "Can't parse getRegistrationCode response"
ShowConnectionFailed()
return ""
endif
if xml.GetName() <> "result"
Dbg("Bad register response: ", xml.GetName())
ShowConnectionFailed()
return ""
endif
if islist(xml.GetBody()) = false then
Dbg("No registration information available")
ShowConnectionFailed()
return ""
endif
'set default value for validate
validate = "fail"
'handle validation of response fields
for each e in xml.GetBody()
if e.GetName() = "validate" then
validate = e.GetBody() 'pass or fail
endif
next
if validate = "" then
Dbg("Parse yields empty validation result")
ShowConnectionFailed()
endif
if validate = "pass" then return true
endif
return false
End Function
<result>
<validate>pass</validate>
</result>
<?
// Define settings
$dbserver = "mysql"; // Change as required
$dbname = "mydatabase"; // Whatever DB you have access to
$dbuser = "myusername"; // User to connect to DB as
$dbpass = "mypassword";// Password for DB user
$code="";
// Connect to DB
$dbconn = mysql_connect("mysql","myusername","mypassword");
if (!$dbconn) die("Error connecting to database!");
if (!mysql_select_db($dbname)) die("Error selecting database $dbname");
// Get args
$code = !empty($_REQUEST['code']) ? mysql_real_escape_string($_REQUEST['code']) : "";
// Verify args
if (empty($code)) die("Missing or invalid Code");
$sql = "SELECT * FROM `users` WHERE code =\"" . $code."\"";
//echo "sql follows";
//echo "<br>";
//echo $sql;
// Get a specific result from the "example" table
$result = mysql_query($sql) or die(mysql_error());
// get the first (and hopefully only) entry from the result
$row = mysql_fetch_array($result);
// Print out the contents of each row into a table
echo $row['code'];
?>
<?php
$con = mysql_connect("localhost","user","password");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("database_name", $con);
$regToken = $_GET['RegToken'];
$sql = mysql_query("select 1 from reg_tokens where regToken = '$regToken'");
$row = mysql_fetch_array($sql);
if ( ! mysql_num_rows($sql)) {
$status = 'fail';
} else {
$status = 'pass';
}
?>
<result>
<validate><?php echo $status; ?></validate>
</result>
"ShifterFilms" wrote:
Thanks to Joel for pointing me in the right direction! I'd like to share my code. The BrightScript I posted above is unchanged. Here is the PHP script which will authenticate a token you've written to your database. Please note, this script assumes that the mysql row you've stored the user's token is associated with that user. Basically, if the token is in the database, this script will ensure a previously validated user passes authentication and gets to the content they have paid for.
<?php
$con = mysql_connect("localhost","user","password");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("database_name", $con);
$regToken = $_GET['RegToken'];
$sql = mysql_query("select 1 from reg_tokens where regToken = '$regToken'");
$row = mysql_fetch_array($sql);
if ( ! mysql_num_rows($sql)) {
$status = 'fail';
} else {
$status = 'pass';
}
?>
<result>
<validate><?php echo $status; ?></validate>
</result>
"atheling" wrote:
You can register an action with Wordpress for "init" which will get called after Wordpress sets up its database object but before anything is output for the request. In that action you can check for the token validation/authentication request and if that's what it is then output the validation and exit. That means you don't have to futz with opening the database yourself and you can make your Wordpress plugin (I assume that is how you are implementing this) compatible on its database access. And you can use your URL for your Wordpress based site without having to worry about conflicts with page names, etc.
Also, even in this trivial case, just passing a get parameter to your select query is opening you up to SQL injection attacks....