Fix failure to escape HTML on login page

[sql-web.git] / tpl / login.php

<?php
include 'head.php';

$thisTxt = isSSL()?' using this Certificate':' using your MySQL Password';
?>

<h3>Login</h3>

<?php printErrors($err); ?>

<?php if (!isSSL()): ?>

<form method=post action="<?=$URI?>">
<p>Please enter your MySQL login information:</p>
<p>username: <input type="text" name="u" value="<?=isset($i_u)?htmlentities($i_u):''?>"></p>
<p>password: <input type="password" name="p"></p>

<?php elseif (isSSL() && !empty($SSLCred)): ?>

<form method=post action="<?=$URI?>">
<p>You are identified as: <?=htmlentities($SSLUsername)?></p>
<p><?=htmlentities($SSLName)?></p>
<p><?=htmlentities($SSLEmail)?></p>

<?php endif; ?>

<?php if (!isSSL() || $LoginSSL->canLogin()): ?>

<input type=submit value="Login<?=$thisTxt?>">
</form>

<?php elseif (isSSL() && !is_null($SSLCred)): ?>

<p><a href="do/signup">Sign up</a> to use this service.</p>

<?php endif; ?>

<?php
include 'foot.php';
?>