include_once '/themes/default/views/layouts/main.php';
 
function showContent() {
[...]
}

include_once('/includes/functions.php'); //why this include doesn't work for login.php
 
// html and php code
 
showContent(); //will include login.php

<?php
include_once('/includes/functions.php');
 
sec_session_start();
 
if (login_check($mysqli) == true) {
    $logged = 'in';
} else {
    $logged = 'out';
}
?>

include_once 'config.php';
$mysqli = new mysqli(HOST, USER, PASSWORD, DATABASE);

function sec_session_start() {   // Esta es la linea 6 de functions.php
    $session_name = 'sec_session_id';   // Set a custom session name
    $secure = SECURE;
    // This stops javascript being able to access the session id.
    $httponly = true;
    // Forces sessions to only use cookies.
    if (ini_set('session.use_only_cookies', 1) === FALSE) {
        header("Location: /error?err=Could not initiate a safe session (ini_set)");
        exit();
    }
    // Gets current cookies params.
    $cookieParams = session_get_cookie_params();
    session_set_cookie_params($cookieParams["lifetime"],
        $cookieParams["path"],
        $cookieParams["domain"],
        $secure,
        $httponly);
    // Sets the session name to the one set above.
    session_name($session_name);
    session_start();            // Start the PHP session
    session_regenerate_id();    // regenerated the session, delete the old one.
}    // Esta es la linea 26 de functions.php

// Check the username - regformhash()
 
    re = /^\w+$+/b; // esta es la linea 31

<form action="includes/process_login.php" method="post" name="login_form">
	Email: <input type="text" name="email" />
	Password: <input type="password"
					 name="password"
					 id="password"/>
	<input type="button"
		   value="Login"
		   onclick="formhash(this.form, this.form.password);" />
</form>

function formhash(form, password) {
    // Create a new element input, this will be our hashed password field. 
    var p = document.createElement("input");
 
    // Add the new element to our form. 
    form.appendChild(p);
    p.name = "p";
    p.type = "hidden";
    p.value = hex_sha512(password.value);
 
    // Make sure the plaintext password doesn't get sent. 
    password.value = "";
 
    // Finally submit the form. 
    form.submit();
}

<a href="index.php?x=pagename">Link</a>

$_GET['x']; -> $_SERVER['QUERY_STRING'];

<a href="index.php?pagename">Link</a>

0x6C740000B61E0100424DB61E010000000000360000002800000080000000BF0000000100180000000000801E010000000000000000000000000000000000

//test.php
 
//header('Content-Type: image/jpeg');
 
$hex = 'hex code';
 
$filename = 'image.jpg';
 
file_put_contents($filename, pack('H*', $hex));
 

//ip function
function get_ip_address() {
	if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
		$ip = $_SERVER['HTTP_CLIENT_IP'];
	} elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
		$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
	} else {
		$ip = $_SERVER['REMOTE_ADDR'];
	}
}
 

//time function
function get_current_time() {
	$time = date('d/m/Y H:i:s', time());
}
 

//record attempt or failed login
$now = time();
$login_time = get_current_time();
$access_address = get_ip_address();
 
$mysqli->query("INSERT INTO login_attempts(user_id, used_password, time, login_time, access_address)
				VALUES ('$user_id', '$used_password', '$now', '$login_time', '$access_address')");
 

// Insert the new user into the database
$reg_time = get_current_time();
$reg_ip = get_ip_address();
if ($insert_stmt = $mysqli->prepare("INSERT INTO members (username, email, password, salt, reg_time, reg_ip) VALUES (?, ?, ?, ?, ?, ?)")) {
	$insert_stmt->bind_param('ssssss', $username, $email, $password, $random_salt, $reg_time, $reg_ip);
	// Execute the prepared query.
	if (! $insert_stmt->execute()) {
		header('Location: ../error.php?err=Registration failure: Contacte al administrador.');
	}
}
 

.boxy {
    background: none repeat scroll 0 0 #F7F7F9;
    border: 2px solid #FFFFFF;
    border-radius: 7px 7px 7px 7px;
    box-shadow: 0 0 0 1px rgba(0, 0, 2, 0.1), 0 1px 0 rgba(0, 0, 2, 0.15), 0 1px 1px rgba(0, 0, 2, 0.1);
    padding: 13px;
    text-shadow: 0 1px 0 #FDFDFF;
    margin: 10px;
}

<div class="menu">
	<div class="secondmenu">
		<ul>
			<li><a>'.$row['id'].'</a></li>
			<li><a href="amigo.php?id='.$row['id'].'">'.$row['nombre'].'</a></li>
			<li><a>'.$row['status'].'</a></li>
			<li><a>'.$row['bonus'].'</a></li>
		</ul>
	</div>
</div>
';
 

function login($email, $password, $mysqli) {
    // Using prepared statements means that SQL injection is not possible.
    if ($stmt = $mysqli->prepare("SELECT id, username, password, salt
        FROM members
       WHERE email = ?
        LIMIT 1")) {
        $stmt->bind_param('s', $email);  // Bind "$email" to parameter.
        $stmt->execute();    // Execute the prepared query.
        $stmt->store_result();
 
        // get variables from result.
        $stmt->bind_result($user_id, $username, $db_password, $salt);
        $stmt->fetch();
 
        // hash the password with the unique salt.
        $password = hash('sha512', $password . $salt);
        if ($stmt->num_rows == 1) {
            // If the user exists we check if the account is locked
            // from too many login attempts
 
            if (checkbrute($user_id, $mysqli) == true) {
                // Account is locked
                // Send an email to user saying their account is locked
                return false;
            } else {
                // Check if the password in the database matches
                // the password the user submitted.
                if ($db_password == $password) {
                    // Password is correct!
                    // Get the user-agent string of the user.
                    $user_browser = $_SERVER['HTTP_USER_AGENT'];
                    // XSS protection as we might print this value
                    $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                    $_SESSION['user_id'] = $user_id;
                    // XSS protection as we might print this value
                    $username = preg_replace("/[^a-zA-Z0-9_\-]+/",
                                                                "",
                                                                $username);
                    $_SESSION['username'] = $username;
                    $_SESSION['login_string'] = hash('sha512',
                              $password . $user_browser);
                    // Login successful.
                    return true;
                } else {
                    // Password is not correct
                    // We record this attempt in the database
                    $now = time();
                    $mysqli->query("INSERT INTO login_attempts(user_id, time)
                                    VALUES ('$user_id', '$now')");
                    return false;
                }
            }
        } else {
            // No user exists.
            return false;
        }
    }
}

$query = sprintf("SELECT rc_usuario.*, rc_referidos.*
	FROM rc_referidos
	INNER JOIN rc_usuario ON rc_usuario.idUsuario = rc_referidos.idReferido
	WHERE rc_referidos.idRedComercio2 = '$connectedUserID'",
	mysql_real_escape_string($idUsuario),
	mysql_real_escape_string($idRedComercio),
	mysql_real_escape_string($idReferido));
 
$data = mysql_query($query);
 
while ($op = mysql_fetch_assoc($data)) {
	$op['id'];
	$op['nombre'];
	$op['apellidos'];
	$op['status'];
 
	echo'
		<div class="menu">
			<div class="secondmenu">
				<ul>
					<li><a>'.$op['id'].'</a></li>
					<li><a href="index.php?r=usuario/amigo">'.$op['nombre'].'</a></li>
					<li><a>'.$op['apellidos'].'</a></li>
					<li><a>'.$op['status'].'</a></li>
				</ul>&nbsp;
			</div>
		</div>
		';
	echo'&nbsp;';
}