User management for the world wide web

UserAccount.php

<?php
class GenieGate_UserAccount {
  var $DBH;


  var $LISTENERS = array();
  
  function GenieGate_UserAccount(&$dbh){
    $this->DBH = $dbh;
  }
  function addListener(&$listener){
    array_push($this->LISTENERS,$listener);
  }

  function createUserAccount(&$fields,&$mview){
    $errors = $this->checkNewUserFields($fields);
    $this->fireCheckUserAccount($fields,$errors);
    if(count($errors) > 0){
      return($errors);
    }
    // Flag tells us that it has been confirmed.
    $c = "Y";
    if($mview){
      $c = "U";
    }
    $id = rand(1,5000); // Used for confirm.
    $sql = sprintf("INSERT into ua_users (id,created,uid,email,name,password,confirm) VALUES('$id',CURRENT_DATE,'%s','%s','%s','%s','$c')",        
           mysql_escape_string($fields[uid]),
           mysql_escape_string($fields[email]),
           mysql_escape_string($fields[name]),
           mysql_escape_string($fields[password])
           );
    mysql_query($sql,$this->DBH) or die("Database error: " . mysql_error($this->DBH));
    // Send an email asking them to confirm.
    if($mview){
      $mview->param("ACCOUNT",$fields);
      $mview->param("CONF_NO",$id);
    }
    // No mailview object. This means the account is confirmed and
    // needs to be set up.
    if(! $mview){
        $this->fireSetupUserAccount($fields,$id);
    }
    return($errors);
  }

    function createConfirmedUserAccount(&$fields){

        # First we check it.
        $errors = $this->checkNewUserFields($fields);
        $this->fireCheckUserAccount($fields,$errors);
        if(count($errors)){
            return($errors);
        }
        $sql = sprintf("INSERT into ua_users (id,created,uid,email,name,password,confirm) VALUES('$id',CURRENT_DATE,'%s','%s','%s','%s','Y')",         
                        mysql_escape_string($fields[uid]),
                        mysql_escape_string($fields[email]),
                        mysql_escape_string($fields[name]),
                        mysql_escape_string($fields[password])
                    );
        mysql_query($sql,$this->DBH) or die("Database error: " . mysql_error($this->DBH));
        $this->fireSetupUserAccount($fields,$id);
        return($errors);
    }


  function updateUserAccount($uid,&$fields){
    // We might need this for the plugin.
    $user = $this->lookupUid($uid);
    if(! $user){
      return(FALSE);
    }    
    $sql = sprintf("UPDATE ua_users SET email='%s',password='%s',name='%s' WHERE uid='%s'",
           mysql_escape_string($fields[email]),
           mysql_escape_string($fields[password]),
           mysql_escape_string($fields[name]),
           mysql_escape_string($uid));
    mysql_query($sql,$this->DBH) or die("Database error: " . mysql_error($this->DBH));    
    $this->fireUserAccountChange($uid,$user,$fields);
  }
  function getUserStats(){
    $stats = array();
    $sql = "SELECT MAX(created), MIN(created), COUNT(id) FROM ua_users";
    $result = mysql_query($sql,$this->DBH) or die(mysql_error($this->DBH));
    $row =  mysql_fetch_row($result);
    $stats[signup_newest]= $row[0];
    $stats[signup_oldest]= $row[1];
    $stats[total_users]= $row[2];
    mysql_free_result($result);
    $sql = "SELECT COUNT(id) FROM ua_users WHERE confirm='Y'";
    $result = mysql_query($sql,$this->DBH) or die(mysql_error($this->DBH));
    $row =  mysql_fetch_row($result);
    $stats[registered_users]= $row[0];
    return($stats);
  }

  function scanUsers($keyword){
    $users = array();    
    $string = mysql_escape_string(str_replace("*","%",strtolower($keyword)));
    $sql = "SELECT id,uid,created,confirm,email,name,password FROM ua_users ";
    $sql .= "WHERE LCASE(CONCAT(uid,name,email,created,password)) LIKE '%$string%'";
    $result = mysql_query($sql,$this->DBH) or die(mysql_error($this->DBH));
    if($result) {
      while($row = mysql_fetch_assoc($result)){
    array_push($users,$row);
      }
    }
    mysql_free_result($result);
    return($users);
  }

  function searchUsers($email,$name,$from,$to){
    $name = mysql_escape_string(str_replace("*","%",strtolower($name)));
    $email = mysql_escape_string(str_replace("*","%",strtolower($email)));
    $to = mysql_escape_string($to);
    $from = mysql_escape_string($from);
    $sql = "SELECT id,uid,created,confirm,email,name,password FROM ua_users ";
    $sql .= sprintf("WHERE created <= '%s' AND created >= '%s' AND name LIKE('%s') AND email LIKE('%s')",
            $to, $from,$name,$email);   
    $users = array();
    $result = mysql_query($sql,$this->DBH) or die(mysql_error($this->DBH));
    if($result) {
      while($row = mysql_fetch_assoc($result)){
    array_push($users,$row);
      }
    }
    mysql_free_result($result);
    return($users);
  }

    function removeUser($uid,$password = "", $confirm = TRUE){
        $fields = $this->lookupUid($uid);
        if($fields){      
            if($confirm){
                if($fields[password] != $password){
                    error_log("Password for [$uid] not [$fields[password]]");
                    return(FALSE);
                }
            }
            $sql = sprintf("DELETE FROM ua_users WHERE uid='%s'",mysql_escape_string($uid));
            mysql_query($sql,$this->DBH);
            $this->fireRemoveUser($uid,$fields);     
        }
        return(TRUE);
    }
   
  function confirmUserAccount($uid,$conf_no){
    $errors = array();
    $fields = $this->lookupUid($uid);
    if(! $fields){
      array_push($errors,"Invalid User");
    }
    if($fields[id] != $conf_no){
      if($fields){
          array_push($errors,"Invalid Account.");     
      }
    }
    $this->firePreConfirmUserAccount($fields,$conf_no,$errors);
    if(count($errors) > 0){
      return($errors);
    }
    $sql = sprintf("UPDATE ua_users SET confirm='Y' WHERE uid='%s' AND id='%s'",
           mysql_escape_string($uid),
           mysql_escape_string($conf_no));    
    mysql_query($sql,$this->DBH) or die(mysql_error());    

    $this->fireSetupUserAccount($fields,$conf_id);
    return($errors);
  }

  function expungeNonConfirmed($all = FALSE){
      if($all){
          $sql = "DELETE FROM ua_users WHERE confirm='U'";
      }else{
          $sql = "DELETE FROM ua_users WHERE confirm='U' AND created < CURRENT_DATE";
      }
      mysql_query($sql,$this->DBH) or die("Database error: " . mysql_error($this->DBH));
  }

  function fireUserAccountChange($uid,&$old_values, &$new_values){
    foreach($this->LISTENERS as $l){
      $l->userInfoChanged($this,$uid,$old_values,$new_values);
    }
  }

  function fireSetupUserAccount(&$fields,$conf_id){ 
    foreach($this->LISTENERS as $l){
      $l->setupUser($this,$fields,$conf_id);
    }
  }


  function fireRemoveUser($uid,&$fields){
    foreach($this->LISTENERS as $l){
      $l->removeUser($this,$uid,$fields);
    }
  }


  function firePreConfirmUserAccount(&$fields,$conf_id,&$errors){
    foreach($this->LISTENERS as $l){
      $l->preConfirm($this,$fields,$conf_id,$errors);
    }
    return;
  }
  function fireCheckUserAccount(&$fields,&$errors){ 
    foreach($this->LISTENERS as $l){
      $l->preCheck($this,$fields,$errors);        
    }
  }

  function checkNewUserFields(&$fields,$is_new = TRUE){
    $errors = array();
    $email = $fields[email];
    if(! ereg('.+@.+\..+',$email)){
      array_push($errors,"Invalid Email address");    
    }else{
      if($is_new){
          if($this->lookupEmail($email)){
              array_push($errors,"Email address already exists");
          }
      }
    }  
    if(preg_match("/\W/",$gid)){
        array_push($errors,"User ID may contain only letters and numbers.");
    }
    if(strlen($fields[uid]) > 1){
        if($is_new){
            if($this->lookupUid($fields[uid])){
                array_push($errors,"User ID already taken.");
            }
        }
    }else{
        array_push($errors,"Invalid user ID.");
    }
    if(strlen($fields[password]) < 6){
        array_push($errors,"Invalid password, (must be longer)");
    }   
    return($errors);    
  }
  
    function lookupUid($uid){
        $sql = sprintf("SELECT id,uid,created,confirm,email,name,password FROM ua_users WHERE uid='%s'",
            mysql_escape_string($uid));
        $rs = mysql_query($sql,$this->DBH);
        if($rs){
            $user =  mysql_fetch_assoc($rs);
            mysql_free_result($rs);
            if($user[uid]){
                return($user);
            }
        }
        return(FALSE);
  }

  function lookupEmail($email){
    $sql = sprintf("SELECT id,uid,created,confirm,email,name,password FROM ua_users WHERE email='%s'",
           mysql_escape_string($email));
    
    $rs = mysql_query($sql,$this->DBH);
    if($rs){
      $user =  mysql_fetch_assoc($rs);
      mysql_free_result($rs);
      if($user[uid]){
    return($user);
      }      
    }
    return(FALSE);
  }
} 
?>

---

Documentation generated by DoxyGen