<?
require "include/bittorrent.php";
dbconn();

loggedinorreturn(); // To ensure that only those who have logged in can delete an account - Security reason

if ($HTTP_SERVER_VARS["REQUEST_METHOD"] == "POST")
{
$username = trim($_POST["username"]);
$password = trim($_POST["password"]);
if (!$username || !$password)
stderr("Error", "Please fill out the form correctly.");
$res = mysql_query(

"SELECT * FROM users WHERE username=" . sqlesc($username) .
" && passhash=md5(concat(secret,concat(" . sqlesc($password) . ",secret)))") or sqlerr(__FILE__, __LINE__);
if (mysql_num_rows($res) != 1)
stderr("Error", "Bad user name or password. Please verify that all entered information is correct.");
$arr = mysql_fetch_assoc($res);

$id = 0+$arr['id'];

if($CURUSER['id'] != $id) { // Auto Post for attempted illegal deletion of user account by another user. RK.

// Added username to subject for easier identification. RK.
$subject = sqlesc("Attempted account deletion of ".$username);
$body = sqlesc("[url=http://funsharing.net/userdetails.php?id=".$CURUSER['id'].
"]".$CURUSER['username']."[/url] has just attempted to delete the account of ".
"[url=http://funsharing.net/userdetails.php?id=".$id.
"]".$username."[/url], using the delacct.php script");

auto_post($subject,$body); // New Function to AutoPost to system forum.

stderr("Warning","You are trying to delete another members' account");
}

// deletion logger code
$dt = sqlesc(get_date_time(gmtime()));
$username = sqlesc($arr['username']); // refetch to ensure correct case.
$email = sqlesc($arr['email']);
$added = sqlesc($arr['added']);
$la = sqlesc($arr['last_access']);
$ip = sqlesc($arr['ip']);
$class = $arr['class'];

// This line inserts the userdata into delusers for reference
mysql_query("INSERT INTO delusers (userid, deleterid, username, email, added, last_access, ip, class, deleted) VALUES($id, $id, $username, $email, $added, $la, $ip, $class, $dt)");

// remove account once the data is safe
$res = mysql_query("DELETE FROM users WHERE id=$id") or sqlerr();
if (mysql_affected_rows() != 1)
stderr("Error", "Unable to delete the account.");


$subject = sqlesc("Account ".$username." deleted.");
$body = sqlesc("".$username." has successfully deleted their account, ID ".$id.", using the delacct.php script");
auto_post($subject,$body); // Successful deletion.

stderr("Success", "The account <b>$username</b> was deleted.");
}
stdhead("Delete account");
?>
<h1>Delete account</h1>
<table border=1 cellspacing=0 cellpadding=5>
<form method=post action=delacct.php>
<tr><td class=rowhead>User name</td><td><input size=40 name=username></td></tr>
<tr><td class=rowhead>Password</td><td><input type=password size=40 name=password></td></tr>
<tr><td colspan=2><input type=submit class=btn value='Delete'></td></tr>
</form>
</table>
<?
stdfoot();
?>