/**
* url: /?p=api_key
* Returns api_key for user by basic authentication
* {
*   api_token: "TOKEN"
*  }
*/
function getAPIKey()
{
    header("Content-Type: application/json; charset=utf-8");
    $user = $_SERVER["PHP_AUTH_USER"];
    $password = $_SERVER["PHP_AUTH_PW"];
    if ($user == "" || $password == "") {
        // user is not authenticated
        header("WWW-Authenticate: Basic realm=Authorization Required");
        header("HTTP/1.1 401 unauthorized");
        echo "{\"error\": \"please send basic auth header\"}";
        die;
    } else {
        // check user
        $foundUser = sql_select("SELECT * FROM `User` WHERE `Nick`='" . sql_escape($user) . "'");
        // find user by username
        if (count($foundUser) == 1) {
            $user = $foundUser[0];
            if (verify_password($password, $user['Passwort'], $user['UID'])) {
                echo "{\"api_token\": \"" . $user["api_key"] . "\"}";
            }
        } else {
            // TODO: handle wrong auth
            header("HTTP/1.1 403 Forbidden");
            echo "{\"error\": \"forbidden\"}";
        }
        die;
    }
}

/**
 * Delete a user, requires to enter own password for reasons.
 */
function user_delete_controller()
{
    global $privileges, $user;
    if (isset($_REQUEST['user_id'])) {
        $user_source = User($_REQUEST['user_id']);
    } else {
        $user_source = $user;
    }
    if (!in_array('admin_user', $privileges)) {
        redirect(page_link_to(''));
    }
    // You cannot delete yourself
    if ($user['UID'] == $user_source['UID']) {
        error(_("You cannot delete yourself."));
        redirect(user_link($user));
    }
    if (isset($_REQUEST['submit'])) {
        $ok = true;
        if (!(isset($_REQUEST['password']) && verify_password($_REQUEST['password'], $user['Passwort'], $user['UID']))) {
            $ok = false;
            error(_("Your password is incorrect.  Please try it again."));
        }
        if ($ok) {
            $result = User_delete($user_source['UID']);
            if ($result === false) {
                engelsystem_error('Unable to delete user.');
            }
            mail_user_delete($user_source);
            success(_("User deleted."));
            engelsystem_log(sprintf("Deleted %s", User_Nick_render($user_source)));
            redirect(users_link());
        }
    }
    return array(sprintf(_("Delete %s"), $user_source['Nick']), User_delete_view($user_source));
}

function change_password($users, $passwords, $user, $old, $new)
{
    if (verify_password($users, $passwords, $user, $old)) {
        $new_salt = generate_random_string(20);
        $passwords[array_keys($users, $user)][0] = hash_password($new, $new_salt);
        $passwords[array_keys($users, $user)][1] = $new_salt;
        logout();
    }
}

 private function checkPassword($form)
 {
     $pass = $form->getValue('password');
     $user = $this->getDataSource()->getCustomerByEmail($form->getValue('username'));
     if ($user && verify_password($pass, $user->customer_pw)) {
         $this->userCache = $user;
         return;
     }
     return 'Wrong username or password';
 }

function verify($pseudo, $password)
{
    //verification pseudo
    $pseudo_verification = verify_pseudo($pseudo);
    //verification mots de passe
    if ($pseudo_verification) {
        $password_verification = verify_password($pseudo, $password);
    }
    return $pseudo_verification and $password_verification;
}

 public function user_login()
 {
     $user_name = $this->input->post('user_name');
     $query = $this->db->get_where($this->table_users, array('user_name' => $user_name));
     if ($query->num_rows() == 1) {
         $user = $query->row();
         $hash = $user->user_password;
         $pass = $this->input->post('user_password');
         if (verify_password($pass, $hash)) {
             $this->session->set_userdata('logged_in', 1);
             $this->session->set_userdata('user_id', $user->user_id);
             $this->session->set_userdata('user_name', $user->user_name);
             $this->session->set_userdata('user_display_name', $user->user_display_name);
             return TRUE;
         } else {
             return FALSE;
         }
     } else {
         return FALSE;
     }
 }

function validate_registration_form($form)
{
    $errors = [];
    $firstName = $form["firstName"];
    $lastName = $form["lastName"];
    $userName = $form["userName"];
    $password = $form["password"];
    if (!$firstName) {
        $errors["firstName"] = "First name is required";
    }
    if (!$lastName) {
        $errors["lastName"] = "Last name is required";
    }
    $userNameValid = filter_var($form["userName"], FILTER_VALIDATE_EMAIL);
    if (!$userNameValid) {
        $errors["userName"] = "User name is required and should be a valid email address";
    }
    $passwordValid = verify_password($password);
    if (!$passwordValid) {
        $errors["password"] = "Password is required at least 1 alpha and at least 1 numeric. It should have at least 6 characters and no more than 12 characters. No special characters (except \$, _)";
    }
    return $errors;
}

 unset($_SESSION['error_msg']);
 unset($_SESSION['info']);
 // Get new user information.
 $_SESSION['raw_password'] = $_POST['password'];
 $_SESSION['raw_pseudo'] = $_POST['pseudo'];
 $password = filter_input(INPUT_POST, 'password', FILTER_VALIDATE_REGEXP, $password_pattern);
 $username = trim(filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING));
 $user = getUserByUsernameOrEmail($username);
 if ($user == NULL) {
     $_SESSION['error_msg'] = "Incorrect username or email.";
     $_SESSION['wrong_username'] = true;
     header('location: /app/admin/login/');
     exit;
 }
 // Check if the password matches the one in the database.
 $valid = verify_password($password, $user['password']);
 if (!$valid) {
     $_SESSION['error_msg'] = "Incorrect password.";
     $_SESSION['wrong_password'] = true;
     header('location: /app/admin/login/');
     exit;
 }
 // The operation is a success, clear error states.
 unset($_SESSION['wrong_username']);
 unset($_SESSION['wrong_password']);
 unset($_SESSION['raw_username']);
 unset($_SESSION['raw_password']);
 unset($_SESSION['error_msg']);
 $_SESSION['loggedin'] = true;
 $_SESSION['email'] = $user['email'];
 $_SESSION['user_ID'] = $user['user_ID'];

     $sex_list = 'M|F|N';
     $sex = check_action($sex_list, $sex, 'N');
     $member['sex'] = $sex;
 }
 if ($level_id > 0) {
     $member['level_id'] = $level_id;
 }
 if ($status > 0) {
     $member['status'] = $status;
 }
 if (!empty($password)) {
     $member['password'] = md5($password . PASSWORD_END);
     if (empty($old_password)) {
         $response['errcontent']['old_password'] = '请填写旧密码';
     } else {
         if (!verify_password($account, $old_password)) {
             $response['errcontent']['old_password'] = '旧密码错误';
         }
     }
 }
 if (!empty($super_password)) {
     $member['super_password'] = md5($super_password . PASSWORD_END);
     if (empty($old_password)) {
         $response['errcontent']['old_password'] = '请填写旧密码';
     } else {
         if (!verify_super_password($account, $old_password)) {
             $response['errcontent']['old_password'] = '旧密码错误';
         }
     }
 }
 if (count($response['errcontent']) == 0 && $response['errmsg'] == '') {

function user_settings()
{
    global $enable_tshirt_size, $tshirt_sizes, $themes, $locales;
    global $user;
    $msg = "";
    $nick = $user['Nick'];
    $lastname = $user['Name'];
    $prename = $user['Vorname'];
    $age = $user['Alter'];
    $tel = $user['Telefon'];
    $dect = $user['DECT'];
    $mobile = $user['Handy'];
    $mail = $user['email'];
    $email_shiftinfo = $user['email_shiftinfo'];
    $jabber = $user['jabber'];
    $hometown = $user['Hometown'];
    $tshirt_size = $user['Size'];
    $password_hash = "";
    $selected_theme = $user['color'];
    $selected_language = $user['Sprache'];
    $planned_arrival_date = $user['planned_arrival_date'];
    $planned_departure_date = $user['planned_departure_date'];
    if (isset($_REQUEST['submit'])) {
        $ok = true;
        if (isset($_REQUEST['mail']) && strlen(strip_request_item('mail')) > 0) {
            $mail = strip_request_item('mail');
            if (!check_email($mail)) {
                $ok = false;
                $msg .= error(_("E-mail address is not correct."), true);
            }
        } else {
            $ok = false;
            $msg .= error(_("Please enter your e-mail."), true);
        }
        $email_shiftinfo = isset($_REQUEST['email_shiftinfo']);
        if (isset($_REQUEST['jabber']) && strlen(strip_request_item('jabber')) > 0) {
            $jabber = strip_request_item('jabber');
            if (!check_email($jabber)) {
                $ok = false;
                $msg .= error(_("Please check your jabber account information."), true);
            }
        }
        if (isset($_REQUEST['tshirt_size']) && isset($tshirt_sizes[$_REQUEST['tshirt_size']])) {
            $tshirt_size = $_REQUEST['tshirt_size'];
        } elseif ($enable_tshirt_size) {
            $ok = false;
        }
        if (isset($_REQUEST['planned_arrival_date']) && DateTime::createFromFormat("Y-m-d", trim($_REQUEST['planned_arrival_date']))) {
            $planned_arrival_date = DateTime::createFromFormat("Y-m-d", trim($_REQUEST['planned_arrival_date']))->getTimestamp();
        } else {
            $ok = false;
            $msg .= error(_("Please enter your planned date of arrival."), true);
        }
        if (isset($_REQUEST['planned_departure_date']) && $_REQUEST['planned_departure_date'] != '') {
            if (DateTime::createFromFormat("Y-m-d", trim($_REQUEST['planned_departure_date']))) {
                $planned_departure_date = DateTime::createFromFormat("Y-m-d", trim($_REQUEST['planned_departure_date']))->getTimestamp();
            } else {
                $ok = false;
                $msg .= error(_("Please enter your planned date of departure."), true);
            }
        } else {
            $planned_departure_date = null;
        }
        // Trivia
        if (isset($_REQUEST['lastname'])) {
            $lastname = strip_request_item('lastname');
        }
        if (isset($_REQUEST['prename'])) {
            $prename = strip_request_item('prename');
        }
        if (isset($_REQUEST['age']) && preg_match("/^[0-9]{0,4}\$/", $_REQUEST['age'])) {
            $age = strip_request_item('age');
        }
        if (isset($_REQUEST['tel'])) {
            $tel = strip_request_item('tel');
        }
        if (isset($_REQUEST['dect'])) {
            $dect = strip_request_item('dect');
        }
        if (isset($_REQUEST['mobile'])) {
            $mobile = strip_request_item('mobile');
        }
        if (isset($_REQUEST['hometown'])) {
            $hometown = strip_request_item('hometown');
        }
        if ($ok) {
            sql_query("\n          UPDATE `User` SET\n          `Nick`='" . sql_escape($nick) . "',\n          `Vorname`='" . sql_escape($prename) . "',\n          `Name`='" . sql_escape($lastname) . "',\n          `Alter`='" . sql_escape($age) . "',\n          `Telefon`='" . sql_escape($tel) . "',\n          `DECT`='" . sql_escape($dect) . "',\n          `Handy`='" . sql_escape($mobile) . "',\n          `email`='" . sql_escape($mail) . "',\n          `email_shiftinfo`=" . sql_bool($email_shiftinfo) . ",\n          `jabber`='" . sql_escape($jabber) . "',\n          `Size`='" . sql_escape($tshirt_size) . "',\n          `Hometown`='" . sql_escape($hometown) . "',\n          `planned_arrival_date`='" . sql_escape($planned_arrival_date) . "',\n          `planned_departure_date`=" . sql_null($planned_departure_date) . "\n          WHERE `UID`='" . sql_escape($user['UID']) . "'");
            success(_("Settings saved."));
            redirect(page_link_to('user_settings'));
        }
    } elseif (isset($_REQUEST['submit_password'])) {
        $ok = true;
        if (!isset($_REQUEST['password']) || !verify_password($_REQUEST['password'], $user['Passwort'], $user['UID'])) {
            $msg .= error(_("-> not OK. Please try again."), true);
        } elseif (strlen($_REQUEST['new_password']) < MIN_PASSWORD_LENGTH) {
            $msg .= error(_("Your password is to short (please use at least 6 characters)."), true);
        } elseif ($_REQUEST['new_password'] != $_REQUEST['new_password2']) {
            $msg .= error(_("Your passwords don't match."), true);
        } elseif (set_password($user['UID'], $_REQUEST['new_password'])) {
            success(_("Password saved."));
//.........这里部分代码省略.........

<?php

header('Content-Type: text/xml');
include 'login_functions.php';
echo '<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>';
echo '<Errors>';
$connection = connectDB();
$login = $_POST['login'];
$v_log = verify_login($connection, $login);
echo '<errorLogin>';
if ($v_log === 1) {
    echo 'images/yes1.png';
} else {
    echo 'images/no1.png';
}
echo '</errorLogin>';
echo '<errorPassword>';
if (isset($_POST['password'])) {
    $password = $_POST['password'];
    $login = $_POST['login2'];
    if (verify_password($connection, $login, $password) === 1) {
        echo 'images/yes1.png';
    } else {
        echo 'images/no1.png';
    }
}
echo '</errorPassword>';
echo '</Errors>';

function main_validation($email, $password1, $password2, $fname, $lname, $sex)
{
    if (verify_email($email) == true and verify_password($password1, $password2, $lname) == true and validate_sex($sex) == true) {
        //$username = validate_username($username);
        $password = sha1($password1);
        $cxn = $GLOBALS['cxn'];
        $last_ip = $_SERVER['REMOTE_ADDR'];
        $priv = "user";
        $query = "INSERT INTO user_list (email, password, first_name, last_name, date_added, last_login, last_ip, privlege_level, sex) \n\t\t\t\tVALUES(?, ?, ?, ?, NOW(), NOW(), ?, ?, ?)";
        $stm2 = $cxn->prepare($query);
        if ($GLOBALS['$debug'] == true) {
            echo $email . "..." . $password . "..." . $fname . "..." . $lname . "..." . $last_ip . "..." . $priv . "..." . $sex;
        }
        $stm2->bind_param("sssssss", $email, $password, $fname, $lname, $last_ip, $priv, $sex);
        $stm2->execute();
        $stm2->close();
        // pull user ID for session data
        $uid = get_user_id($email);
        //// set session infos
        $_SESSION['signed_in'] = true;
        $_SESSION['fname'] = $fname;
        $_SESSION['email'] = $email;
        $_SESSION['user_id'] = $uid;
        $_SESSION['privleges'] = "user";
        //$_SESSION['city'] = $city;
        //$_SESSION['state'] = $state;
        return true;
    } else {
        $_SESSION['signed_in'] = false;
        return false;
    }
}

 if ($user != NULL) {
     $_SESSION['error_msg'] = "This username already exists.";
     $_SESSION['wrong_username'] = true;
     header('location: /content/signin_assignment/?action=signup');
     exit;
 }
 // Check if the password meets the requirements.
 if (!$password) {
     $_SESSION['error_msg'] = "Your password must contain at least 8 characters and be composed of at least 1 number, 1 uppercase letter and 1 lowercase letter.";
     $_SESSION['wrong_password'] = true;
     header('location: /content/signin_assignment/?action=signup');
     exit;
 }
 // Check if password and verifiy match>
 $hashed_password = hash_password($password);
 $verified = verify_password($verify, $hashed_password);
 if (!$verified) {
     $_SESSION['error_msg'] = "The password doesn't match.";
     $_SESSION['wrong_verify'] = true;
     header('location: /content/signin_assignment/?action=signup');
     exit;
 }
 // Insert new user.
 $user['username'] = $username;
 $user['password'] = $hashed_password;
 $result = add_user($user);
 if ($result != 1) {
     $_SESSION['info'] = 'The registration failed with a result of ' . $result . ' record(s) added';
     header('location: /content/signin_assignment/?action=signup');
     exit;
 }

function main_validation($email, $password)
{
    $errors = $GLOBALS['errors'];
    $email2 = verify_email($email);
    if ($email2 != false) {
        if (verify_password($password, $email2)) {
            $cxn = $GLOBALS['cxn'];
            $query_email = "SELECT user_id, first_name, privlege_level FROM user_list WHERE email=?";
            $stm2 = $cxn->prepare($query_email);
            $stm2->bind_param("s", $email2);
            $stm2->execute();
            $stm2->bind_result($user_id, $first_name, $privleges);
            $stm2->fetch();
            $stm2->close();
            $last_ip = $_SERVER['REMOTE_ADDR'];
            //pulled out the one in the table, so we don't need to use prepareds again.
            $query_login_time = "UPDATE user_list SET last_login=NOW(), last_ip='{$last_ip}' WHERE user_id='{$user_id}' ";
            $res = mysqli_query($cxn, $query_login_time) or die("error: " . mysqli_error($cxn));
            /// set session infos
            $_SESSION['signed_in'] = true;
            $_SESSION['email'] = $email2;
            $_SESSION['fname'] = $first_name;
            $_SESSION['user_id'] = $user_id;
            $_SESSION['privleges'] = $privleges;
            //$_SESSION['city'] = $city;
            //$_SESSION['state'] = $state;
            $arr = array("user_id" => $user_id, "name" => $first_name);
            return $arr;
        } else {
            $errors .= "password did not match our records";
            $GLOBALS['errors'] = $errors;
            $_SESSION['signed_in'] = false;
            return array("user_id" => 0, "name" => "failure");
        }
    } else {
        $errors .= "email was not found";
        $GLOBALS['errors'] = $errors;
        $_SESSION['signed_in'] = false;
        return array("user_id" => 0, "name" => "failure");
    }
}

function guest_login()
{
    global $user, $privileges;
    $nick = "";
    unset($_SESSION['uid']);
    if (isset($_REQUEST['submit'])) {
        $ok = true;
        if (isset($_REQUEST['nick']) && strlen(User_validate_Nick($_REQUEST['nick'])) > 0) {
            $nick = User_validate_Nick($_REQUEST['nick']);
            $login_user = sql_select("SELECT * FROM `User` WHERE `Nick`='" . sql_escape($nick) . "'");
            if (count($login_user) > 0) {
                $login_user = $login_user[0];
                if (isset($_REQUEST['password'])) {
                    if (!verify_password($_REQUEST['password'], $login_user['Passwort'], $login_user['UID'])) {
                        $ok = false;
                        error(_("Your password is incorrect.  Please try it again."));
                    } else {
                        //password is okay, check confirmaiton
                        if ($login_user['user_account_approved'] !== '1') {
                            $ok = false;
                            error(_("Your account is not confirmed yet. Please click the link in the mail we sent you. If you didn't get an eMail, ask a dispatcher."));
                        }
                    }
                } else {
                    $ok = false;
                    error(_("Please enter a password."));
                }
            } else {
                $ok = false;
                error(_("No user was found with that Nickname. Please try again. If you are still having problems, ask an Dispatcher."));
            }
        } else {
            $ok = false;
            error(_("Please enter a nickname."));
        }
        if ($ok) {
            $_SESSION['uid'] = $login_user['UID'];
            $_SESSION['locale'] = $login_user['Sprache'];
            redirect(page_link_to('shifts'));
        }
    }
    if (in_array('register', $privileges)) {
        $register_hint = join('', array('<p>' . _("Please sign up, if you want to help us!") . '</p>', buttons(array(button(page_link_to('register'), register_title() . ' &raquo;')))));
    } else {
        $register_hint = join('', array(error(_('Registration is disabled.'), true)));
    }
    return page_with_title(login_title(), array(msg(), '<div class="row"><div class="col-md-6">', form(array(form_text('nick', _("Nick"), $nick), form_password('password', _("Password")), form_submit('submit', _("Login")), buttons(array(button(page_link_to('user_password_recovery'), _("I forgot my password")))), info(_("Please note: You have to activate cookies!"), true))), '</div></div>'));
}

<?php

// rather than have login pages spread throughout the site let's have one place for logging in
// that's easy to remember
require_once 'cvs-auth.inc';
commonHeader("Administration Login");
print "<br />\n";
if (!get_user()) {
    if (isset($_POST['submit']) && isset($_POST['pass'])) {
        $user = verify_password(htmlentities($_POST['user']), htmlentities($_POST['pass']), $_SERVER['PHP_SELF']);
    } else {
        $user = null;
        ?>
	<h1>Administration Login</h1>
	<form action = "<?php 
        echo $_SERVER['PHP_SELF'];
        ?>
" method = 'POST'>
	<table border='0' cellpadding='3' bgcolor='#e0e0e0' width=<?php 
        echo isset($SIDEBAR_DATA) ? '50%' : '40%';
        ?>
>
	<tr>
	<td><br />User name:</td>
	<td><br /><input type = 'text' name = 'user' value = "<?php 
        echo $user;
        ?>
"><br /></td>
	<tr>
	<td>Password:</td>
	<td><input type = 'password' name = 'pass' value = '' size = '12'><br /></td>

	Unless required by applicable law or agreed to in writing, software
	distributed under the License is distributed on an "AS IS" BASIS,
	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	See the License for the specific language governing permissions and
	limitations under the License.
*/
$errorMessage = rawurlencode("Your username and password could not be authenticated.");
$username = $_POST["username"];
$password = $_POST["password"];
if (trim($username) != "" && trim($password) != "") {
    $usernameArray = explode("@", $username);
    $userQuery = db_query("SELECT id,accessLevel,displayListSize FROM user WHERE active=1 AND username=" . escapeQuote($usernameArray[0]));
    if (db_numrows($userQuery) == 1) {
        $userResult = db_fetch($userQuery);
        if (!verify_password($usernameArray[0], $password)) {
            header("Location: /index.php?errorMessage={$errorMessage}");
            exit;
        }
        /* Count the number of workgroups this user is a member of. */
        $workgroupQuery = db_query("SELECT workgroupId FROM workgroupUser WHERE userId=" . $userResult["id"]);
        $numWorkgroups = db_numrows($workgroupQuery);
        $workgroupResult = @db_fetch($workgroupQuery);
        /* Update the session table. */
        db_query("UPDATE session SET timeout=" . (date("U") + 14400) . ",userId=" . $userResult["id"] . ",accessLevel=" . $userResult["accessLevel"] . ",displayListSize=" . $userResult["displayListSize"] . ",numWorkgroups={$numWorkgroups}" . ",currentWorkgroup=" . $workgroupResult["workgroupId"] . " WHERE id=" . escapeQuote($dss_sessionCookie));
        /* User the last login date. */
        db_query("UPDATE user SET lastLoginDate=" . date("U") . " WHERE id=" . $userResult["id"]);
        header("Location: /index.php");
    } else {
        header("Location: /index.php?errorMessage={$errorMessage}");
    }

function guest_login()
{
    global $user, $privileges;
    $nick = "";
    unset($_SESSION['uid']);
    if (isset($_REQUEST['submit'])) {
        $ok = true;
        if (isset($_REQUEST['nick']) && strlen(User_validate_Nick($_REQUEST['nick'])) > 0) {
            $nick = User_validate_Nick($_REQUEST['nick']);
            $login_user = sql_select("SELECT * FROM `User` WHERE `Nick`='" . sql_escape($nick) . "'");
            if (count($login_user) > 0) {
                $login_user = $login_user[0];
                if (isset($_REQUEST['password'])) {
                    if (!verify_password($_REQUEST['password'], $login_user['Passwort'], $login_user['UID'])) {
                        $ok = false;
                        error(_("Your password is incorrect.  Please try it again."));
                    }
                } else {
                    $ok = false;
                    error(_("Please enter a password."));
                }
            } else {
                $ok = false;
                error(_("No user was found with that Nickname. Please try again. If you are still having problems, ask an Dispatcher."));
            }
        } else {
            $ok = false;
            error(_("Please enter a nickname."));
        }
        if ($ok) {
            $_SESSION['uid'] = $login_user['UID'];
            $_SESSION['locale'] = $login_user['Sprache'];
            redirect(page_link_to('news'));
        }
    }
    if (in_array('register', $privileges)) {
        $register_hint = join('', array('<p>' . _("Please sign up, if you want to help us!") . '</p>', buttons(array(button(page_link_to('register'), register_title() . ' &raquo;')))));
    } else {
        $register_hint = join('', array(error(_('Registration is disabled.'), true)));
    }
    return page_with_title(login_title(), array(msg(), '<div class="row"><div class="col-md-6">', form(array(form_text('nick', _("Nick"), $nick), form_password('password', _("Password")), form_submit('submit', _("Login")), buttons(array(button(page_link_to('user_password_recovery'), _("I forgot my password")))), info(_("Please note: You have to activate cookies!"), true))), '</div>', '<div class="col-md-6">', '<h2>' . register_title() . '</h2>', $register_hint, '<h2>' . _("What can I do?") . '</h2>', '<p>' . _("Please read about the jobs you can do to help us.") . '</p>', buttons(array(button(page_link_to('angeltypes') . '&action=about', _("Teams/Job description") . ' &raquo;'))), '</div></div>'));
}

                 <?php 
            if (isset($_POST['save'])) {
                echo ' checked="checked"';
            }
            ?>
 />
               </td>
              </tr>
             </table>

            </div>

<?php 
        }
    } else {
        if ($user && $pw && verify_password($user, $pw)) {
            ///FIXME make sure this works for the reporter that doesn't have an account
            if ((!isset($_POST['in']) || !is_array($_POST['in'])) && !$auth_user) {
                ?>

                <div class="explain">
                 Welcome back, <?php 
                echo $user;
                ?>
! (Not <?php 
                echo $user;
                ?>
?
                 <a href="?logout=1&amp;id=<?php 
                echo $id;
                ?>

        $bank_account = $db->escape($bank_account);
    }
    if ($bank_card == '') {
        $response['msg'] .= '-请填写银行卡号<br/>';
    } else {
        $bank_card = $db->escape($bank_card);
    }
    if ($mobile == '') {
        $response['msg'] .= '-请填写手机号码<br/>';
    } else {
        $mobile = $db->escape($mobile);
    }
    if ($password == '') {
        $response['msg'] .= '-请填写账户密码<br/>';
    } else {
        if (!verify_password($_SESSION['account'], $password)) {
            $response['msg'] .= '-账户密码错误<br/>';
        }
    }
    if ($response['msg'] == '') {
        $bank_card_data = array('account' => $_SESSION['account'], 'bank' => $bank, 'bank_card' => $bank_card, 'bank_account' => $bank_account, 'mobile' => $mobile);
        if ($db->autoInsert('bank_card', array($bank_card_data))) {
            $response['error'] = 0;
            $response['msg'] = '添加银行卡成功';
        } else {
            $response['msg'] = '001:系统繁忙，请稍后再试';
        }
    }
    echo json_encode($response);
    exit;
}