///////////////////////////////////////////////////////////////////////////////
// File: edit.php
// Purpose: for administrator to edit/delete guestbook entry as well as reply to guestbook entries
// Remarks: 1. requires common.php
// 2. Default: display form
// "Edit entry": attempts to update entry
// "Delete entry": attempts to delete entry
///////////////////////////////////////////////////////////////////////////////
// Functions: none
///////////////////////////////////////////////////////////////////////////////
require("./common.php");
session_start();
if(isset($_SESSION['admin_name']))
// IMPT: check if user is administrator first
{
if(isset($_POST['action']) && $_POST['action']=="Edit entry")
// EDIT ENTRY: process confirmation of edit
{
$new_username=addslashes(htmlentities($_POST['new_username']));
$new_useremail=htmlentities($_POST['new_useremail']);
$new_homepage=addslashes(htmlentities($_POST['new_homepage']));
$new_subject=addslashes(htmlentities($_POST['new_subject']));
$new_message=addslashes(htmlentities($_POST['new_message']));
$new_reply=addslashes(htmlentities($_POST['new_reply']));
$postdate=$_POST['postdate'];
$entryid=$_POST['entryid'];
$link_id=db_connect();
$query="UPDATE $posts_table "
."SET username='$new_username', "
."useremail='$new_useremail', "
."homepage='$new_homepage', "
."subject='$new_subject', "
."message='$new_message', "
."postdate='$postdate', "
."reply='$new_reply' "
."WHERE entryid='$entryid'";
$result=mysql_query($query);
if(mysql_affected_rows($link_id) == 1)
{
redirectheader("./index.php?page={$_POST['page']}");
echo "
\n";
echo "
$sitename - Editing entry \n";
echo "All changes have been saved!
\n";
echo "You'll be taken back to the page you came from.
\n";
echo "Alternatively, you can click
here if you can't wait.\n";
echo "
\n";
}
else if(mysql_affected_rows($link_id) == 0)
{
redirectheader("./index.php?page={$_POST['page']}");
echo "\n";
echo "
$sitename - Editing entry \n";
echo "
You've made no changes! \n";
echo "You'll be taken back to the page you came from.
\n";
echo "Alternatively, you can click
here if you can't wait.\n";
echo "
\n";
}
else
{
pageheader("$sitename - Error");
echo "\n";
echo "
Error \n";
echo "
An error has occurred! Entry NOT updated! \n";
echo "
$query \n";
echo "Back to
Guestbook \n";
echo "
\n";
}
}
else if(isset($_POST['action']) && $_POST['action']=="Delete entry")
// DELETE ENTRY: process confirmation of deletion
{
$link_id=db_connect();
$entryid=$_POST['entryid'];
$query="DELETE FROM $posts_table
WHERE entryid=$entryid";
$result=mysql_query($query);
if(mysql_affected_rows($link_id) == 1)
{
redirectheader("./index.php?page={$_POST['page']}");
echo "\n";
echo "
$sitename - Deleting entry \n";
echo "Entry deleted!
\n";
echo "You'll be taken back to the page you came from.
\n";
echo "Alternatively, you can click
here if you can't wait.\n";
echo "
\n";
}
else
{
pageheader("$sitename - Error");
echo "\n";
echo "
Error \n";
echo "
An error has occurred! Entry NOT deleted! ";
echo "
\n";
echo "Back to
Guestbook \n";
echo "
\n";
}
}
else
// Default action: display form for editing/deleting entry
{
db_connect();
$entryid=$_GET['entryid'];
$query="SELECT username,useremail,homepage,subject,message,date_format(postdate,'%D %b %Y, %r') AS date,postdate, reply
FROM $posts_table
WHERE entryid=$entryid";
$result=mysql_query($query); // retrieve selected entry from db
pageheader("$sitename - Editing entry");
echo "Editing guestbook entry ";
if($entry=mysql_fetch_array($result))
// entry exists
// display entry and ask for confirmation
{
?>
}
else
// entry doesn't exist or cannot be retrieved
{
pageheader("$sitename - Editing entry");
echo "\nSelected entry does not exist or cannot be retrieved. \n";
echo " \n";
echo " \n";
}
}
}
else
// user is NOT logged in as administrator\
{
not_logged_error();
}
pagefooter();
?>