Просмотр файла mnen.php

<?php
include 'inc/db.php';
include 'inc/1.php';
$time=time();
function hc($in){
return htmlspecialchars($in);
}
function me($in){
return mysql_escape_string($in);
}
if (($user['admin']==1) && isset($_GET['del'])){
$d=intval($_GET['del']);
mysql_query("DELETE FROM `mnen` WHERE `id` = '$d'");
echo "<div class='msg'>Удалено</div>";
}
$to=htmlspecialchars($_GET['to']);
if ($_POST['msg'] && $user && (mysql_num_rows(mysql_query("SELECT * FROM `mnen` WHERE `user` = '$user[id]'"))==0)){
$msg=mysql_escape_string($_POST['msg']);
mysql_query("INSERT INTO `mnen` (`id`, `msg`, `user`, `time`) values (NULL, '$msg', '".$user['id']."', '$time')");
echo "<div class='msg'>Сообщение добавлено</div>";
}
if (!$_GET['p'])$_GET['p']=1;
$page=intval($_GET['p']);
$start=($page*15-15);
$q=mysql_query("SELECT * FROM `mnen` ORDER BY `time` DESC LIMIT $start, 15");
$qq=mt_rand(1111, 9999);
if ((mysql_num_rows(mysql_query("SELECT * FROM `mnen` WHERE `user` = '$user[id]'"))==0) && $user){if ($_GET['to'])echo "<div class='input'><a href='?q=$qq'>Обновить</a><br><form action='?' method='POST'>Сообщение:<br><textarea name='msg'>$to, </textarea><br><input type='submit' name='OK' value='Добавить'></form></div>";
else
echo "<div class='input'><a href='?q=$qq'>Обновить</a><br><form action='?' method='POST'>Сообщение:<br><textarea name='msg'></textarea><br><input type='submit' name='OK' value='Добавить'></form></div>";}
$a=1;
while ($f=mysql_fetch_assoc($q)){
$ank=mysql_fetch_assoc(mysql_query("SELECT * FROM `user` WHERE `id` = '$f[user]'"));
$ololo=smile(hc($f['msg']));
echo "<div class='p".($a%2)."'>".im($ank['id'])." <a href='mnen.php?to=".hc($ank['name'])."'>".hc($ank['name'])."</a>".on($ank['id'])." (".vremja($f['time']).")<br>$ololo";
if ($user['admin']==1)echo "<br><a href='?del=$f[id]'>[<font color='red'>x</font> Удалить]</a>";
echo "</div>";
$a++;
}
echo "<div align='center'>";
if ($page>1)echo "<a href='mnen.php?p=".($page-1)."'>Назад</a> ";
if (mysql_num_rows(mysql_query("SELECT * FROM `mnen`"))>($start+15)) echo "<a href='?p=".($page+1)."'>Далее</a>";
include_once 'inc/foot.php';
?>