<?
$first = rand(1, 26);
$second = rand(1, 26);
$third = rand(1, 26);
$fourth = rand(1, 26);
$captcha = ("$first  $second  $third  $fourth");
include("lib/captcha/captcha.php?code=$captcha");
                        ?><img src="lib/captcha/captcha.php?code=<?=$captcha;?>" border="1" align="left"><?
$captcha = preg_replace("10", "J", $captcha);
$captcha = preg_replace("11", "K", $captcha);
$captcha = preg_replace("12", "L", $captcha);
$captcha = preg_replace("13", "M", $captcha);
$captcha = preg_replace("14", "N", $captcha);
$captcha = preg_replace("15", "O", $captcha);
$captcha = preg_replace("16", "P", $captcha);
$captcha = preg_replace("17", "Q", $captcha);
$captcha = preg_replace("18", "R", $captcha);
$captcha = preg_replace("19", "S", $captcha);
$captcha = preg_replace("20", "T", $captcha);
$captcha = preg_replace("21", "U", $captcha);
$captcha = preg_replace("22", "V", $captcha);
$captcha = preg_replace("23", "W", $captcha);
$captcha = preg_replace("24", "X", $captcha);
$captcha = preg_replace("25", "Y", $captcha);
$captcha = preg_replace("26", "Z", $captcha);
$captcha = preg_replace("0", "", $captcha);
$captcha = preg_replace("1", "A", $captcha);
$captcha = preg_replace("2", "B", $captcha);
$captcha = preg_replace("3", "C", $captcha);
$captcha = preg_replace("4", "D", $captcha);
$captcha = preg_replace("5", "E", $captcha);
$captcha = preg_replace("6", "F", $captcha);
$captcha = preg_replace("7", "G", $captcha);
$captcha = preg_replace("8", "H", $captcha);
$captcha = preg_replace("9", "I", $captcha);
$captcha 		= str_replace(" ", "",$captcha);
$_SESSION['captcha'] = $captcha;
?>

<?php //Als er op de inlog knop gedrukt word
if(isset($_POST['login'])){
  //Input filteren
  $name = htmlspecialchars(addslashes($_POST['username'])); 
  $ww = htmlspecialchars(addslashes($_POST['password']));
  //Wachtwoord omzetten naar md5 
  $wwmd5 = md5($_POST['password']);
  $wwmd5 = mysqli_real_escape_string($connection, $wwmd5);
   
  //Gegevens laden voor het foute inloggen.
  $inlog_fout_sql = $connection->query("SELECT `datum`, `ip`, `spelernaam` FROM `inlog_fout` WHERE `ip`='".$_SERVER['REMOTE_ADDR']."' ORDER BY `id` DESC");
  $inlog_fout = mysqli_fetch_array($inlog_fout_sql); 
  $aftellen = 1200-(time()-strtotime($inlog_fout['datum']));
   
  //Geen inlognaam ingevuld
  if($_POST['username'] == '')
    $inlog_error = $txt['alert_no_username'];
  //Geen wachtwoord ingevoerd
  elseif($ww == '')
    $inlog_error = $txt['alert_no_password'];
  //Is het wel drie keer mis gegaan
  elseif((mysqli_num_rows($inlog_fout_sql) >= 3) AND ($inlog_fout['ip'] === $_SERVER['REMOTE_ADDR']) AND ($aftellen > 0)) {
    $inlog_error = $txt['alert_time_sentence'].' <span><script type="text/javascript">writetimer("'.$aftellen.'")</script></span>';
  }
  else{
    if($aftellen < 0)
    $connection->query("DELETE FROM `inlog_fout` WHERE `ip`='".mysqli_real_escape_string($connection, $_SERVER['REMOTE_ADDR'])."'");


    // Gegevens laden om te kijken voor de gebruiker
	$naam = mysqli_real_escape_string($connection, $_POST['username']);
    $gegevens_sql = mysqli_query("SELECT `user_id`, `username`, `wachtwoord`, `premiumaccount`, `account_code` FROM `gebruikers` WHERE `username`='".$naam."'"); 
    // Gegevens laden om te kijken voor de gebruiker
    $gegeven_sql  = mysqli_query("SELECT `username`, `wachtwoord`, `account_code` FROM `gebruikers` WHERE `wachtwoord`='".$wwmd5."' AND `username`='".$naam."'");
    $gegeven = mysqli_fetch_array($gegevens_sql);


    if(mysqli_num_rows($gegevens_sql) == 0)
      $inlog_error = $txt['alert_unknown_username'];
    elseif($gegeven['username'] != $naam)
      $inlog_error = $txt['alert_unknown_username'];
    //Kijken of account niet is verbannen
    elseif(mysqli_num_rows($connection->query("SELECT user_id FROM ban WHERE user_id = '".mysqli_real_escape_string($connection, $gegeven['user_id'])."'")) > 0)
  	  $inlog_error = $txt['alert_account_banned'];
    elseif(mysqli_num_rows($gegeven_sql) == 0){
      $datum = date("Y-m-d H:i:s");
      $connection->query("INSERT INTO `inlog_fout` (`datum`, `ip`, `spelernaam`, `wachtwoord`) 
        VALUES ('".$datum."', '".$_SERVER['REMOTE_ADDR']."', '".$naam."', '".$ww."')");


      if((mysqli_num_rows($inlog_fout_sql) == 2) AND ($gegeven['wachtwoord'] != $wwmd5))
        $inlog_error = $txt['alert_timepenalty'];
      elseif((mysqli_num_rows($inlog_fout_sql) == 1) AND ($gegeven['wachtwoord'] != $wwmd5))
        $inlog_error = $txt['alert_trys_left_1'];
      elseif((mysqli_num_rows($inlog_fout_sql) == 0) AND ($gegeven['wachtwoord'] != $wwmd5))
        $inlog_error = $txt['alert_trys_left_2'];
    }
    elseif($gegeven['account_code'] != 1)
      $inlog_error = $txt['alert_account_not_activated'];
    else{
      //If Onthoud Check box is checked save cookie
      if($_POST['remember'] == "on"){
        setcookie("pa_1", $gegeven['username'], time()+(60*60*24*365));
        setcookie("pa_2", $_POST['password'], time()+(60*60*24*365));
      }
      
      //Zorgen dat gebruiker weer 3 pogingen heeft.
      mysqli_query("DELETE FROM `inlog_fout` WHERE `ip`='".mysqli_real_escape_string($connection, $_SERVER['REMOTE_ADDR'])."'");
      
      //tijd opslaan dat het lid inlogt, zodat de site weet dat hij online is.
      $tijd = time();
      mysqli_query("UPDATE `gebruikers` SET `ip_ingelogd`='".$_SERVER['REMOTE_ADDR']."', `online`='".$tijd."' WHERE `username`='".mysqli_real_escape_string($connection, $gegeven['username'])."'");
      
      //Datum opvragen
      $date = date("Y-m-d H:i:s");
      //Opslaan in de inlog_logs tabel
      $queryloginlogs = mysqli_query("SELECT `id` FROM `inlog_logs` WHERE `ip`='".mysqli_real_escape_string($connection, $_SERVER['REMOTE_ADDR'])."' AND `speler`='".mysqli_real_escape_string($connection, $gegeven['username'])."'");
      if(mysqli_num_rows($queryloginlogs) == "0"){
        mysqli_query("INSERT INTO `inlog_logs` (`ip`, `datum`, `speler`) 
          VALUES ('".$_SERVER['REMOTE_ADDR']."', '".$date."', '".$naam."')");
      }
      else
        mysqli_query("UPDATE `inlog_logs` SET `datum`='".$date."' WHERE `speler`='".mysqli_real_escape_string($connection, $gegeven['username'])."' AND `ip`='".mysqli_real_escape_string($connection, $_SERVER['REMOTE_ADDR'])."'");
      
      //zet naam in variabele, zodat het later nog gebruikt kan worden
      $_SESSION['id'] = $gegeven['user_id'];
      $_SESSION['naam'] = $gegeven['username'];
      //Hash opslaan
      $_SESSION['hash'] = md5($_SERVER['REMOTE_ADDR'].",".$gegeven['username']);
      //Ben je wel premium
      if($gegeven['premiumaccount'] > 0)
        $_SESSION['userid'] = $gegeven['id'];
      //naar de ingame pagina sturen
      header('location: index.php');
    }
  }
}
?>

//Cache Query in txt
function query_cache($page,$query,$expire){
  $file = 'cache/'.$page.'.txt';
  if (file_exists($file) &&
      filemtime($file) > (time() - $expire)) {
      $records = unserialize(file_get_contents($file));
  } else {                                  
      $result = mysqli_query($query) or die (mysqli_error());
      while ($record = mysqli_fetch_assoc($result)) $records[] = $record;
      $OUTPUT = serialize($records);
      $fp = fopen($file,"w");
      fputs($fp, $OUTPUT);
      fclose($fp);
  } // end else