SWDB/application/action/edit_profile.php

<?php

    /**
     * File for the profile edit action.
     *
     * Implements an action function to be called from the {@see Controller}.
     * 
     * @category Action
     */

    /**
     * Executes the profile update.
     *
     * Reads the POST parameters looking for the following KEYS:
     *  mail
     *  pass + currentPass
     *  api
     * Then it updates the selected info with the prameter vlue. Multiple
     * itemas can be updated at the same time.
     * 
     * @return int|string 0 on success, negative values on error. If the API
     * key has been updated, the new key.
     * @category Action
     * @global resource Database connection.
     */
    function action(){

        global $db;

        $response = null;

        // TODO: Dont pass user as argument, use currently logged in one.
        $user = filter_input(INPUT_POST, 'user');

        if (filter_input(INPUT_POST, "mail")){
            $mail = filter_input(INPUT_POST, 'mail');
            if (!filter_var($mail, FILTER_VALIDATE_EMAIL)){
                return -1;
            }
            $s = $db->prepare('UPDATE user SET mail = :mail WHERE id = :user;');
            $s->bindValue(':user', $user, SQLITE3_TEXT);
            $s->bindValue(':mail', $mail, SQLITE3_TEXT);
            if(!$s->execute()){
                return -2;
            }
        }

        if (filter_input(INPUT_POST, "pass")){
            $pass = sha1(filter_input(INPUT_POST, 'pass'));
            $currentPass = sha1(filter_input(INPUT_POST, 'currentPass'));
            $s = $db->prepare('SELECT COUNT(id) AS count FROM user WHERE id = :id AND password = :currentPass;');
            $s->bindValue(':id', $user, SQLITE3_TEXT);
            $s->bindValue(':currentPass', $currentPass, SQLITE3_TEXT);
            $q = $s->execute();
            $r = $q->fetchArray(SQLITE3_ASSOC);
            if ($r["count"] != 1){
                return -3;
            }
            $s = $db->prepare('UPDATE user SET password = :pass WHERE id = :id AND password = :currentPass;');
            $s->bindValue(':id', $user, SQLITE3_TEXT);
            $s->bindValue(':pass', $pass, SQLITE3_TEXT);
            $s->bindValue(':currentPass', $currentPass, SQLITE3_TEXT);
            if(!$s->execute()){
                return -4;
            }
        }

        if (filter_input(INPUT_POST, "api")){
            $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
            $charactersLength = 16;
            $api = '';
            for ($i = 0; $i < $charactersLength; $i++) {
                $api .= $characters[rand(0, $charactersLength - 1)];
            }
            $s = $db->prepare('UPDATE user SET api_key = :api WHERE id = :id;');
            $s->bindValue(':id', $user, SQLITE3_TEXT);
            $s->bindValue(':api', $api, SQLITE3_TEXT);
            if(!$s->execute()){
                return -5;
            }
            $response = $api;
        }

        if ($response == null){
            return 0;
        }
        else{
            return $response;
        }
    }
?>