PHPコードは100点あります、それを解く方法

<br /><?php<br /><br />if(!in_array($_POST['type'],array('login','reg'))){<br />	echo -1;<br />	exit();<br />}<br />if($_POST['type']=='login'){<br />	$username=addslashes($_POST['username']);<br />	$pwd=$_POST['pwd'];<br />	$sql="SELECT * FROM test WHERE name='$username'";//test改为user-info<br />	$db=new DB();<br />	if($user_exists=$db->execute_dql($sql)){<br />		if(md5($pwd)==$user_exists[0]['pwd']){<br />			session_start();<br />			$_SESSION['username']=$user_exists[0]['name'];<br />			echo 1;<br />			exit();<br />		}<br />	}else{<br />		echo -1;<br />		exit();<br />	}<br />}elseif($_POST['type']=='reg'){<br />	$username=addslashes($_POST['username']);<br />	$pwd=md5($_POST['pwd']);<br />	$sql_exists="SELECT * FROM test WHERE name='$username'";//test改为user-info<br />	$db=new DB();<br />	if($db->execute_dql($sql_exists)){//已存在该用户<br />		echo -2;<br />		exit();<br />	}<br />	$sql="INSERT INTO test(name,pwd) VALUES('$username','$pwd')";//test改为user-info<br />	if($code=$db->execute_dml($sql)){<br />		session_start();<br />		$_SESSION['username']=stripslashes($username);<br />		echo 1;<br />		exit();<br />	}else{<br />		echo -1;<br />		exit();<br />	}<br />}<br /><br />class DB{<br />	private $conn;<br />	private $host="localhost";//localhost:3307<br />	private $user="root";<br />	private $password="123456";<br />	private $db="test";//bbs<br />	private $res;<br /><br />	function __construct(){<br />		$this->conn=mysql_connect($this->host,$this->user,$this->password);<br />		if(!$this->conn){<br />			die("连接数据库失败".mysql_error());<br />		}<br />		mysql_select_db($this->db,$this->conn);<br />		mysql_query("SET NAMES utf8");<br />	}<br />	function execute_dql($sql){<br />		$this->res=mysql_query($sql,$this->conn) or die(mysql_error());<br />		$r=array();<br />		while($row=mysql_fetch_assoc($this->res)){<br />			$r[]=$row;<br />		}<br />		return $r;<br />	}<br />	function execute_dml($sql){<br />		$b=mysql_query($sql,$this->conn) or die(mysql_error());<br />		if(!$b){<br />			return 0;//失败<br />		}else{<br />			if(mysql_affected_rows($this->conn)>0){<br />				return 1;//成功<br />			}else{<br />				return 2;//没有影响到行数<br />			}<br />		}<br />	}<br />	function __destruct(){<br />		if(!empty($this->res)){<br />			mysql_free_result($this->res);<br />		}<br />		mysql_close($this->conn);<br />	}<br />}<br /><br />?><br />

<br /><?php<br /><br />if(!in_array($_POST['type'],array('login','reg'))){<br />	echo -1;<br />	exit();<br />}<br />if($_POST['type']=='login'){<br />	$username=addslashes($_POST['username']);<br />	$pwd=$_POST['pwd'];<br />	$sql="SELECT * FROM test WHERE name='$username'";//test改为user-info<br />	$db=new DB();<br />	if($user_exists=$db->execute_dql($sql)){<br />		if(md5($pwd)==$user_exists[0]['pwd']){<br />			session_start();<br />			$_SESSION['username']=$user_exists[0]['name'];<br />			echo 1;<br />			exit();<br />		}<br />	}else{<br />		echo -1;<br />		exit();<br />	}<br />}elseif($_POST['type']=='reg'){<br />	$username=addslashes($_POST['username']);<br />	$pwd=md5($_POST['pwd']);<br />	$sql_exists="SELECT * FROM test WHERE name='$username'";//test改为user-info<br />	$db=new DB();<br />	if($db->execute_dql($sql_exists)){//已存在该用户<br />		echo -2;<br />		exit();<br />	}<br />	$sql="INSERT INTO test(name,pwd) VALUES('$username','$pwd')";//test改为user-info<br />	if($code=$db->execute_dml($sql)){<br />		session_start();<br />		$_SESSION['username']=stripslashes($username);<br />		echo 1;<br />		exit();<br />	}else{<br />		echo -1;<br />		exit();<br />	}<br />}<br /><br />class DB{<br />	private $conn;<br />	private $host="localhost";//localhost:3307<br />	private $user="root";<br />	private $password="123456";<br />	private $db="test";//bbs<br />	private $res;<br /><br />	function __construct(){<br />		$this->conn=mysql_connect($this->host,$this->user,$this->password);<br />		if(!$this->conn){<br />			die("连接数据库失败".mysql_error());<br />		}<br />		mysql_select_db($this->db,$this->conn);<br />		mysql_query("SET NAMES utf8");<br />	}<br />	function execute_dql($sql){<br />		$this->res=mysql_query($sql,$this->conn) or die(mysql_error());<br />		$r=array();<br />		while($row=mysql_fetch_assoc($this->res)){<br />			$r[]=$row;<br />		}<br />		return $r;<br />	}<br />	function execute_dml($sql){<br />		$b=mysql_query($sql,$this->conn) or die(mysql_error());<br />		if(!$b){<br />			return 0;//失败<br />		}else{<br />			if(mysql_affected_rows($this->conn)>0){<br />				return 1;//成功<br />			}else{<br />				return 2;//没有影响到行数<br />			}<br />		}<br />	}<br />	function __destruct(){<br />		if(!empty($this->res)){<br />			mysql_free_result($this->res);<br />		}<br />		mysql_close($this->conn);<br />	}<br />}<br /><br />?><br />