Просмотр файла city3/add.php

<?
error_reporting(0);
include "./../ini3.php";
include "./../includes/header2.php";

$id=cyr(htmlspecialchars(stripslashes(trim($id))));
$login=cyr(htmlspecialchars(stripslashes(trim($login))));
$pass=cyr(htmlspecialchars(stripslashes(trim($pass))));

if(!empty($login)) 
{  
$q = mysql_query("select secur,energy,admin,band,guns,cars,id,login,pass,status,reg_data,money,level,police,health,ban,zav,lsd,redaktor from users where login='".cyr($login)."';");
}
elseif(!empty($id))
{
$q = mysql_query("select secur,energy,admin,band,guns,cars,id,login,pass,status,reg_data,money,level,police,health,ban,zav,lsd,redaktor from users where id='".$id."';");
}
else
{
die ($lang['empty_login']."</body></html>");
}

$data = mysql_fetch_array($q);

$id=$data['id'];
$login=$data['login'];
$status=$data['status'];
$reg_data=$data['reg_data'];
$money=$data['money'];
$level=$data['level'];
$admin=$data['admin'];
$redaktor=$data['redaktor'];
if(md5($pass)!=$data['pass'])
{
die ($lang['empty_login']."</small></p></card></wml>");
}

mysql_query("update users set last='".time()."',city='0' where id='".$id."';");




if($redaktor == 0)
{
echo "Ты не редактор!";
}
elseif($redaktor >= 1  && !isset($_GET['newn']) && !isset($_GET['newn2']))

{



echo '<b>Новости</b><br/>
<a href="?newn&amp;id='.$id.'&amp;pass='.$pass.'">Добавить новость</a><br/>
';

}






if(isset($_GET['newn'])&& $redaktor >= 1)
{
echo "<form action=\"?newn2&amp;id=$id&amp;pass=$pass\" method=\"post\">
<postfield name=\"title\" value=\"$(title)\"/>
<postfield name=\"text\" value=\"$(text)\"/>";
print 'Заголовок:<br/>';
print "<input name=\"title\"  value=\"$title\" maxlength=\"50\"/><br/>";
print 'Текст<br/>';
print "<input name=\"text\"  value=\"$text\" maxlength=\"1000\"/><br/>";
echo "<input class=\"ibutton\" type=\"submit\" value=\"".$lang['ok']."\"/></form>";
}
if(isset($_GET['newn2'])&& $redaktor >= 1)
{  $data = mysql_fetch_array($q);


$title=$title;
$text=$text;
$login=$login;
	$time=date("y.m.d H:i");
	$data = mysql_fetch_array($q);
$text = str_replace('И', 'и', $text);
$text = str_replace('ш', 'Ш', $text);
	mysql_query("insert into rnews values('0','$title','$text','$login','$time');");
$count=mysql_num_rows($q);
echo "Новость добавлена!<br/>";
echo "<a href=\"index.php?id=$id&amp;pass=$pass\">В город</a>";
if($count=0)
{
	echo "Ошибка какая-то.";
}


}


mysql_close();
print "</body></html>";
?>