https://gitlab.com/WhileTeam/MinePanel/blob/master/classes/database.class.php global variables are evil, you need to get rid of them better config the config directly in the constructor.
if ((!isset($session[0]) or !isset($session[1])) or (empty($session[0]) or empty($session[1]))) { $this->is_auth = false; unset($_SESSION['auth']); return; }
Does this construction work at all? by the way there is a difference between or and || . Plus empty is a synonym !isset && is_null() i.e. isset superfluous here.
global $db; global again
<?php $mpage['title'] = 'Главная страница'; $users_count = $db->fetch("SELECT COUNT(`id`) FROM `mpk_users`")['COUNT(`id`)']; $last_version = '1.0'; ob_start(); include_once STYLE . '/pages/main.html'; $mpage['content'] = ob_get_clean();
$db not clear from where it appeared. There is no documentation at all.
if (isset($_GET['login']) && $_SERVER['REQUEST_METHOD'] == 'POST') { $login = @$_POST['login']; // нельзя так $passw = @$_POST['password']; if (empty($login) or empty($passw)) { alert('Введите логин/пароль!', 0, 0, 0); } $passw = md5(md5($passw)); $userRow = $db->fetch("SELECT * FROM `mpk_users` WHERE `login` = '{$login}'"); // sql inj уязвимость
here @ definitely nothing: if (empty(@$userRow['login'])){
if ($userRow['password'] != $passw) { alert('Неверный логин/пароль!', 0, 0, 0); }
This query is decided at the sampling stage.
exit(header('Location: index.php')); - well, and why is exit() location going to another page anyway.