function login($username, $passwd)
{
    global $db_link;
    // check if username is unique
    $result = wrap_db_query("SELECT user_id, passwd FROM " . BOOKING_USER_TABLE . " \r\n\t\t\t\t\t\tWHERE username = '" . wrap_db_escape_string($username) . "'");
    if (!$result) {
        return false;
    }
    $fields = wrap_db_fetch_array($result);
    # check to see if username was found
    # also to prevent username = "" sql default
    if (empty($fields)) {
        return false;
    }
    # check for admin login, passwd = NULL
    if ($passwd == "" && $result && $fields[1] == NULL) {
        $passwd = NULL;
    }
    //echo "username: $username<br />";
    //echo "password: $passwd<br />";
    //echo "db field: ".$fields['passwd']."<br />";
    if ($fields['passwd'] == NULL) {
        echo "NULL db passwd<br />";
    }
    if (validate_password($passwd, $fields['passwd'])) {
        return true;
    }
    return false;
}

 public function index()
 {
     checkIE();
     if (IS_POST) {
         $username = I('username', null);
         $password = I('password', null);
         $code = I('code', null);
         $check_verify = $this->_check_verify($code);
         if ($check_verify) {
             $user = D('Member')->getUsersByUsername($username);
             $auth_success = false;
             if ($user) {
                 $auth_success = validate_password($password, $user[0]['salted_hash']);
             }
             if ($auth_success) {
                 $result['code'] = self::SUCCESS_CODE;
                 session('username', $user[0]['username']);
                 session('uid', $user[0]['uid']);
                 session('email', $user[0]['email']);
                 session('groupid', $user[0]['groupid']);
                 session('gender', $user[0]['gender']);
                 session('avatar', $user[0]['avatar']);
             } else {
                 $result['code'] = self::AUTH_FAILED_CODE;
                 $result['error'] = self::AUTH_FAILED_TIP;
             }
         } else {
             $result['code'] = self::VERIFY_FAILED_CODE;
             $result['error'] = self::VERIFY_FAILED_TIP;
         }
         $this->ajaxReturn($result);
     }
     $this->display();
 }

function login($dirty_email, $dirty_password)
{
    $email = escape($dirty_email);
    $password = escape($dirty_password);
    if (!validate_email($email)) {
        echo "login-invalid-email";
        return;
    }
    if (!validate_password($password)) {
        echo "login-invalid-password";
        return;
    }
    $account_id = account_id_from_email($email);
    if ($account_id == -1) {
        echo "DEBUG: email or password invalid";
        return;
    }
    if (correct_password($account_id, $password) == false) {
        echo "DEBUG: email or password invalid";
        return;
    }
    session_regenerate_id();
    fresh_logon($account_id);
    $username = username_from_account_id($account_id);
    setcookie('LOGGED_IN', $username, time() + 3600);
    echo "login-success";
}

function login($username, $passwd)
{
    // check if username is unique
    $result = wrap_db_query("SELECT user_id, passwd FROM " . BOOKING_USER_TABLE . "\n\t\t\t\t\t\tWHERE username = '" . $username . "' AND login_enabled = '1'");
    if (!$result) {
        return false;
    }
    $fields = wrap_db_fetch_array($result);
    # check to see if username was found
    # also to prevent username = "" sql default
    if ($fields[0] == "") {
        return false;
    }
    # check for admin login, passwd = NULL
    if ($passwd == "" && $result && $fields[1] == NULL) {
        $passwd = NULL;
    }
    #echo "username: $username<br />";
    #echo "password: $passwd<br />";
    #echo "db field: $fields[1]<br />";
    #if ($fields[1] == NULL) { echo "NULL db passwd<br />"; }
    if (validate_password($passwd, $fields[1])) {
        return true;
    }
    return false;
}

 public static function authenticate($ps_username, $ps_password = '', $pa_options = null)
 {
     $t_user = new ca_users();
     $t_user->load($ps_username);
     if ($t_user->getPrimaryKey() > 0) {
         $vs_hash = $t_user->get('password');
         if (preg_match('/^[a-f0-9]{32}$/', $vs_hash)) {
             // old-style md5 passwords
             //throw new CaUsersException(_t('The stored password for this user seems to be in legacy format. Please update the user account by resetting the password.'));
             if (md5($ps_password) == $vs_hash) {
                 // if the md5 hash matches, authenticate successfully and move the user over to pbkdf2 key
                 $t_user->setMode(ACCESS_WRITE);
                 // ca_users::update takes care of the hashing by calling AuthenticationManager::updatePassword()
                 $t_user->set('password', $ps_password);
                 $t_user->update();
                 return true;
             } else {
                 return false;
             }
         }
         return validate_password($ps_password, $vs_hash);
     } else {
         return false;
     }
 }

function checkUser($userName, $password)
{
    if (!isset($userName) && !isset($password)) {
        return false;
    }
    include '../../includes/database.php';
    // Retrieve username and password from database according to user's input
    $stmt = $db->prepare("SELECT * FROM " . "users" . " WHERE (`Email` = :Email)");
    $resul = $stmt->execute(array(':Email' => $userName));
    $result = $stmt->fetch();
    $num_rows = $stmt->rowCount();
    // Check username and password match
    //echo $num_rows > 0 &&validate_password($password,$result['password'])?"pasword is real...\n":"not the right pass?\n";
    if ($num_rows > 0 && validate_password($password, $result['password'])) {
        // Set username session variable
        $_SESSION['Email'] = $userName;
        $_SESSION['loggedin'] = true;
        $_SESSION['FName'] = $result['FName'];
        $_SESSION['LName'] = $result['LName'];
        $_SESSION['Index'] = $result['Index'];
        $_SESSION['verified'] = @$result['verified'];
        return true;
    } else {
        return false;
    }
}

/**
 * Set a user's password
 * 
 * @return bool
 * @since 1.8.0
 * @access private
 */
function elgg_set_user_password()
{
    $current_password = get_input('current_password', null, false);
    $password = get_input('password', null, false);
    $password2 = get_input('password2', null, false);
    $user_guid = get_input('guid');
    if (!$user_guid) {
        $user = elgg_get_logged_in_user_entity();
    } else {
        $user = get_entity($user_guid);
    }
    if ($user && $password) {
        // let admin user change anyone's password without knowing it except his own.
        if (!elgg_is_admin_logged_in() || elgg_is_admin_logged_in() && $user->guid == elgg_get_logged_in_user_guid()) {
            $credentials = array('username' => $user->username, 'password' => $current_password);
            try {
                pam_auth_userpass($credentials);
            } catch (LoginException $e) {
                register_error(elgg_echo('LoginException:ChangePasswordFailure'));
                return false;
            }
        }
        try {
            $result = validate_password($password);
        } catch (RegistrationException $e) {
            register_error($e->getMessage());
            return false;
        }
        if ($result) {
            if ($password == $password2) {
                $user->salt = _elgg_generate_password_salt();
                $user->password = generate_user_password($user, $password);
                $user->code = '';
                if ($user->guid == elgg_get_logged_in_user_guid() && !empty($_COOKIE['elggperm'])) {
                    // regenerate remember me code so no other user could
                    // use it to authenticate later
                    $code = _elgg_generate_remember_me_token();
                    $_SESSION['code'] = $code;
                    $user->code = md5($code);
                    setcookie("elggperm", $code, time() + 86400 * 30, "/");
                }
                if ($user->save()) {
                    system_message(elgg_echo('user:password:success'));
                    return true;
                } else {
                    register_error(elgg_echo('user:password:fail'));
                }
            } else {
                register_error(elgg_echo('user:password:fail:notsame'));
            }
        } else {
            register_error(elgg_echo('user:password:fail:tooshort'));
        }
    } else {
        // no change
        return null;
    }
    return false;
}

/** Tarkasta sisaankirjautumislomake
 * @param $email string
 * @param $password string
 * @return boolean
 */
function validate($email, $password)
{
    if (validate_email($email) && validate_password($password)) {
        return true;
    } else {
        return false;
    }
}

 /**
  *
  * @param string $username
  * @param string $password
  * @return Users 
  */
 public function getCredentials($username, $password)
 {
     $query = Doctrine_Query::create()->from('SystemUser')->where('user_name = ?', $username)->andWhere('deleted = 0');
     $user = $query->fetchOne();
     if (validate_password($password, $user->get('user_password'))) {
         return $user;
     }
     return null;
 }

 public function login($username, $password)
 {
     $stmt = $this->dbh->prepare('SELECT * FROM accounts WHERE username = ?');
     $stmt->bindParam(1, $username);
     $stmt->execute();
     $row = $stmt->fetch(PDO::FETCH_ASSOC);
     if (validate_password($password, $row['password'])) {
         return $row;
     }
     return '';
 }

function validate_credentials($form)
{
    $errors = [];
    $userNameValid = validate_username($form);
    if (!$userNameValid) {
        $errors["validation.userName"] = "User name is required and should be an email address";
    }
    $passwordValid = validate_password($form);
    if (!$passwordValid) {
        $errors["validation.password"] = "Password is required and should have at least 4 characters";
    }
    return $errors;
}

/**
 * check if password entered matches DB
 * @param string $url 
 * @param string $pwd 
 * @return boolean true, if password matches
 * @return error message if exception catched during PDO
 */
function verifyPassword($url, $password, $pdo)
{
    try {
        require 'password_hash.php';
        $stmt = $pdo->prepare("SELECT pwdView from note where id = :url");
        $stmt->bindValue(':url', $url, PDO::PARAM_STR);
        $stmt->execute();
        $result = $stmt->fetch(PDO::FETCH_ASSOC);
        return validate_password($password, $result['pwdView']);
    } catch (PDOException $e) {
        throw $e;
    }
}

 public function index()
 {
     $this->load->helper('pbkdf2_helper');
     $pass = create_hash('usr#6379');
     echo $pass;
     echo "<p>" . strlen($pass) . "</p>";
     echo "<p>result:</p>";
     if (validate_password('usr#6379', $pass) == true) {
         echo "validation passed";
     } else {
         echo "didn't pass!";
     }
 }

/**
 * Set a user's password
 * 
 * @return bool
 * @since 1.8.0
 * @access private
 */
function elgg_set_user_password()
{
    $current_password = get_input('current_password');
    $password = get_input('password');
    $password2 = get_input('password2');
    $user_guid = get_input('guid');
    if (!$user_guid) {
        $user = elgg_get_logged_in_user_entity();
    } else {
        $user = get_entity($user_guid);
    }
    if ($user && $password) {
        // let admin user change anyone's password without knowing it except his own.
        if (!elgg_is_admin_logged_in() || elgg_is_admin_logged_in() && $user->guid == elgg_get_logged_in_user_guid()) {
            $credentials = array('username' => $user->username, 'password' => $current_password);
            try {
                pam_auth_userpass($credentials);
            } catch (LoginException $e) {
                register_error(elgg_echo('LoginException:ChangePasswordFailure'));
                return false;
            }
        }
        try {
            $result = validate_password($password);
        } catch (RegistrationException $e) {
            register_error($e->getMessage());
            return false;
        }
        if ($result) {
            if ($password == $password2) {
                $user->salt = generate_random_cleartext_password();
                // Reset the salt
                $user->password = generate_user_password($user, $password);
                if ($user->save()) {
                    system_message(elgg_echo('user:password:success'));
                    return true;
                } else {
                    register_error(elgg_echo('user:password:fail'));
                }
            } else {
                register_error(elgg_echo('user:password:fail:notsame'));
            }
        } else {
            register_error(elgg_echo('user:password:fail:tooshort'));
        }
    } else {
        // no change
        return null;
    }
    return false;
}

function verify_account($dirty_username, $dirty_password, $dirty_activation_code)
{
    $username = escape($dirty_username);
    $password = escape($dirty_password);
    $code = escape($dirty_activation_code);
    $validateUsrMsg = validate_username($username);
    if ($validateUsrMsg != "valid-username") {
        return;
    }
    $validatePwdMsg = validate_password($password);
    if ($validatePwdMsg != "valid-password") {
        return;
    }
    $account_id = account_id_from_code($code);
    $sql1 = "SELECT * FROM account_signup WHERE code='{$code}'";
    $result = query($sql1);
    if (mysqli_num_rows($result) == 1) {
        $row = mysqli_fetch_assoc($result);
        $date_requested = $row["date_requested"];
        $expires = $date_requested + 86400;
        if (time() > $expires) {
            echo "validation-expired";
            return;
        }
        $encrypted_password = encrypt_password($password);
        $sql2 = "UPDATE account_head SET status='logged-out' WHERE account={$account_id};";
        query($sql2);
        if (user_has_status($account_id, 'logged-out') == false) {
            echo 'verify-error';
            return;
        }
        $sql3 = "INSERT INTO account_credentials (account, username, password)";
        $sql3 .= " VALUES ({$account_id}, '{$username}', '{$encrypted_password}');";
        query($sql3);
        if (user_has_credentials($account_id, $username, $encrypted_password) == false) {
            echo 'verify-error';
            return;
        }
        $sql4 = "DELETE FROM account_signup WHERE account={$account_id};";
        query($sql4);
        if (user_has_signup_pending($account_id)) {
            echo 'verify-error';
            return;
        }
        echo "verify-success";
        return;
    }
    echo 'verify-error';
}

function auth_username_password($db, $username, $password)
{
    $st = $db->prepare("SELECT access_token, password FROM users WHERE username=? LIMIT 1");
    $st->bind_param("s", $username);
    $st->execute();
    $st->bind_result($token, $hash);
    $st->fetch();
    $st->close();
    hj_log("auth_token_db", $token);
    require_once __DIR__ . '/crypto.inc.php';
    if (validate_password($password, $hash)) {
        hj_log("auth_token_db", $token);
        return $token;
    }
    return NULL;
}

 /**
  * Check password
  *
  * @return object
  */
 public function password()
 {
     $password = utf8_normalize_nfc(request_var('password', '', true));
     if (strlen($password) > $this->config['max_pass_chars']) {
         $return = $this->user->lang('TOO_LONG_USER_PASSWORD');
     } else {
         if (strlen($password) < $this->config['min_pass_chars']) {
             $return = $this->user->lang('TOO_SHORT_USER_PASSWORD');
         } else {
             if ($return = validate_password($password)) {
                 $return = $this->user->lang($return . '_NEW_PASSWORD');
             } else {
                 $return = 0;
             }
         }
     }
     return new Response($return);
 }

 /**
  * Authenticates a user by username/password credentials. Uses the 'users' DB table.
  * @uses User_Model
  * @access public
  * @param string $username
  * @param string $password
  * @return bool
  */
 function auth_user($username, $password)
 {
     $this->load->helper('secure_hash');
     $params = array('username' => $username, 'status' => 'Active');
     if ($user = $this->user_model->get($params, true)) {
         if (validate_password($password, $user->password)) {
             log_message('info', 'User ' . $this->user_model->get_name($user->id) . ' has just logged in!');
             reload_session_caps($user->id);
             return true;
         } else {
             add_message('Incorrect username or password, please verify your details and try again.', 'danger');
             return false;
         }
     } else {
         add_message('Incorrect username or password, please verify your details and try again.', 'danger');
         return false;
     }
 }

 public function verify_user($username, $password)
 {
     //previously sha1
     //$this->load->helper('security');
     //$password_sha1 = do_hash($password, TRUE);
     //Currently pbkdf2
     $this->load->helper('pbkdf2_helper');
     $this->load->helper('date');
     $q = $this->db->where('username', $username)->bracket('open')->where('expires >', date('Y-m-d', now()))->or_where('expires', '0000-00-00')->bracket('close')->limit(1)->get('user');
     if ($q->num_rows > 0) {
         //for pbkdf2
         $good_hash = $q->row()->password;
         if (validate_password($password, $good_hash) === true) {
             return $q->row();
         }
         //for sha1 just return $q->row();
     }
     return false;
 }

/** Tarkasta rekister\"{o}intilomake
 * @param $email string 
 * @param $password string 
 * @param $username string 
 * @return boolean
 */
function validate($email, $password, $username)
{
    if (!validate_email($email)) {
        echo "email wrong";
        return false;
    } else {
        if (!validate_password($password)) {
            echo "password wrong";
            return false;
        } else {
            if (!validate_username($username)) {
                echo "username wrong";
                return false;
            } else {
                echo "correct validation";
                return true;
            }
        }
    }
}