--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/sqlickrypt.c	Sun May 20 15:52:07 2012 -0700
@@ -0,0 +1,73 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <sqlite3.h>
+#include <unistd.h>
+#include <crypt.h>
+
+#define DATABASE "/dgldir/dgamelaunch.db"
+
+int xcallback(void *targ, int ncols, char **vals, char **colnames) {
+  char *pws;
+  int j;
+  pws = *((char **) targ);
+  if (pws == NULL) {
+    for (j = 0; j < ncols; j++) {
+      if (!strcmp(colnames[j], "password"))
+        *((char **) targ) = strdup(vals[j]);
+    }
+  }
+  /* Otherwise, this isn't the first row. */
+  return 0;
+}
+
+int main(int argc, char *argv[]) {
+  char ibuf[160], *uname, *pw, *pwhash = NULL, *comphash;
+  char finduser_sql[160];
+  char *cptr; // Utility pointer
+  sqlite3 *db;
+  int status;
+
+  /* Read in the username and password */
+  fgets(ibuf, 160, stdin);
+  uname = ibuf;
+  pw = strchr(uname, '\n');
+  if (pw == NULL)
+    exit(4); /* Truncated */
+  *pw = '\0';
+  pw++;
+  fgets(pw, 160 - (pw - ibuf), stdin);
+  if (pw[strlen(pw) - 1] == '\n')
+    pw[strlen(pw) - 1] = '\0';
+  else
+    exit(4); /* Truncated */
+  /* Sanitize the username, because it gets put into a query. */
+  for (cptr = uname; *cptr != '\0'; cptr++) {
+    if (!isalnum(*cptr)) {
+      exit(4);
+    }
+  }
+  /* Construct the query */
+  strcpy(finduser_sql, "SELECT * FROM dglusers WHERE username='");
+  strncat(finduser_sql, uname, 40);
+  strcat(finduser_sql, "';");
+
+  status = sqlite3_open(DATABASE, &db);
+  if (status) {
+    sqlite3_close(db);
+    return 1;
+  }
+  sqlite3_exec(db, finduser_sql, xcallback, (void *) &pwhash, NULL);
+
+  sqlite3_close(db);
+
+  /* Now check the password. */
+  if (pwhash == NULL) {
+    return 2;
+  }
+  comphash = crypt(pw, pwhash);
+  if (!strcmp(pwhash, comphash))
+    return 0;
+  return 1;
+}