View file book.php

<?php
// by Mike O. (mides), coolcms.mobi

$title = 'Гостевая';
require_once 'system/sys.php';
require_once 'system/header.php';

switch ($act) {
    default:
        echo '<div class="title"><a href="?">'.$lang['guestbook'].'</a></div>
        <div class="main">
        <form name="form" action="?act=add" method="post">
		'.bbpanel('form', 'text').'
        <textarea name="text" cols="" rows="3"></textarea>';
        if (!$u['id']) {
			echo '<img src="inc/code.php" alt="" /> провер. код:<br/>
            <input name="code" maxlength="5" size="12" /><br />';
        }
        echo '<input name="" type="submit" value="Ok">
        </form>
        </div>';
        $total = mysql_result(mysql_query("SELECT COUNT(`id`) FROM `book`"), 0);
        if ($total > 0) {
            $pages = ceil($total / $config['onpage']);
            if ($page > $pages or $page == 0) {
                    $page = 1;
            }
            $begin = ($page - 1) * $config['onpage'];

            navig($page, '?', $pages);

            echo '</div><div class="list">';

            $book_r = mysql_query("SELECT * FROM `book` ORDER BY `time` DESC LIMIT ".$begin.", ".$config['onpage']."");
            while ($book = mysql_fetch_assoc($book_r)) {
                if (!isset($num) ) $num = 1;  
                $num++;
                $row_class = (!($num % 2)) ? 'row1' : 'row2';	
                echo '<div class="'.$row_class.'">';

                if ($book['id_user'] == 0) {
                        echo $lang['guest'];
                } else {
                        echo '<a href="profile.php?id='.$book['id_user'].'">'.login($book['id_user']).'</a> ';
                }
                echo ' '.ccdate($book['time'], $book['id_user']).' <a href="?act=reply&amp;id='.$book['id'].'">'.$lang['re'].'</a>';
                if ($u['access'] > 0 or $u['id'] and $u['id'] == $book['id_user'] and time() - $book['time'] < $config['edit_time']) echo '|<a href="?act=edit&amp;id='.$book['id'].'">'.$lang['edit'].'</a>';
                if ($u['access'] > 1) echo '|<a href="?act=del&amp;id='.$book['id'].'">Del</a>';
                echo '<br />'.bb($book['text']);
                if ($book['edit_by']) echo '<br />_______<br /><span style="font-size: 10px;">'.$lang['edited_by'].': '.username($book['edit_by']).' ('.date('d.m.y, H:i', $book['edit_time']).' )</span>';
                echo '</div>';
            }
            navig($page, '?', $pages);
        } else {
            echo '</div><div class="list">'.$lang['guestbook_is_empty'];
        }
        nav_main();	
    break;
	
	case 'add':
		if ($u['id']) {
			if (!empty($_POST['text'])) {
				if (time() > $_SESSION['antispam']) {
					$text = check($_POST['text']);
					mysql_query("INSERT INTO `book` SET `id_user` = '$u[id]', `text` = '$text', `time` = '".TIME."'");
					$_SESSION['antispam'] = TIME + $config['antispam'];
					redirect('?');
				} else {
					error($lang['antispam'].' '.$config['antispam'].' sec');
					nav('?');
				}
			} else {
				redirect('?');
			}
		} else {
			if ($_POST['text'] and $_POST['code']) {
				$text = check($_POST['text']);
				$code = check($_POST['code']);
				if ($_SESSION['code'] == $code) {
					if (TIME > $_SESSION['antispam']) {
						mysql_query("INSERT INTO `book` SET `text` = '$text', `time` = '".TIME."'");
						$_SESSION['antispam'] = TIME + $config['antispam'];
						redirect('?');
					} else {
						error($lang['antispam'].' '.$config['antispam'].' sec');
						nav('?');
					}
				} else {
					error($lang['incorrect_code']);
					nav('?');
				}
			} else {
				redirect('?');
			}
		}
	break;
	
	case 'reply':
		$id = abs(intval($_GET['id']));
		$msg_r = mysql_query("SELECT `id`, `id_user` FROM `book` WHERE `id` = '$id'");
		$msg = mysql_fetch_assoc($msg_r);
		if ($msg['id']) {
			if ($ok) {
				if (TIME > $_SESSION['antispam']) {
					if ($u['id']) {
						if (!empty($_POST['text'])) {
							$text = check($_POST['text']);
							mysql_query("INSERT INTO `book` SET `id_user` = '$u[id]', `text` = '$text', `time` = '".TIME."'");
							$_SESSION['antispam'] = TIME + $config['antispam'];
							redirect('?');
						} else {
							redirect('?act=reply&id='.$id);
						}
					} else {
						if (!empty($_POST['text'])) {
							$text = check($_POST['text']);
							$code = abs(intval($_POST['code']));
							if ($_SESSION['code'] == $code) {
								mysql_query("INSERT INTO `book` SET `text` = '$text', `time` = '".TIME."'");
								$_SESSION['antispam'] = TIME + $config['antispam'];
								redirect('?');
							} else {
								error($lang['incorrect_code']);
								nav('?act=reply&amp;id='.$id);
							}
						} else {
							redirect('?act=reply&id='.$id);
						}
					}
				} else {
					error($lang['antispam'].' '.$config['antispam'].' sec');
					nav('?');
				}
			} else {
				tp($lang['reply']);
				echo '<form name="form" action="?act=reply&amp;id='.$id.'&amp;ok=1" method="post">
				'.bbpanel('form', 'text').'<textarea name="text" cols="" rows="3">[b]'.justusername($msg['id_user']).'[/b], </textarea><br />';
				if (!$u['id']) {
					echo '<img src="inc/code.php" alt="" /> провер. код:<br /><input name="code" maxlength="5" size="12" /><br />';
				}
				echo '<input name="submit" type="submit" value="Ok" />
				</form>';
				nav('?');
			}
		} else {
			redirect('?');
		}
	break;
	
	case 'edit':
		if ($u['id']) {
			$id = abs(intval($_GET['id']));
			$book_r = mysql_query("SELECT * FROM `book` WHERE `id` = '$id'");
			$book = mysql_fetch_assoc($book_r);
			if ($book['text']) {
				if ($u['access'] > 0 or $u['id'] == $book['id_user'] and TIME - $book['time'] < $config['edit_time']) {
					tp($lang['edit_msg']);
					if (empty($ok)) {
						echo '<form name="form" action="?act=edit&amp;id='.$id.'&amp;ok=1" method="post">
						'.bbpanel('form', 'text').'<textarea name="text" cols="" rows="3">'.$book['text'].'</textarea>
						<input name="submit" type="submit" value="Ok" />
						</form>';
						nav('?');
					} else {
						if (!empty($_POST['text'])) {
							$text = check($_POST['text']);
							mysql_query("UPDATE `book` SET `text` = '$text', `edit_by` = '$u[id]', `edit_time` = '".TIME."' WHERE `id` = '$id'");
							redirect('?');
						} else {
							redirect('?act=edit&id='.$id);
						}
					}
				} else {
					redirect('?');
				}
			} else {
				redirect('?');
			}
		} else {
			redirect('login.php');
		}
	break;
	
	case 'del':
		if ($u['access'] > 1) {
			$id = abs(intval($_GET['id']));
			$msg_r = mysql_query("SELECT `id` FROM `book` WHERE `id` = '$id'");
			if (mysql_num_rows($msg_r)) {
				mysql_query("DELETE FROM `voting` WHERE `type` = 'book' and `id_for` = '$id'");
				mysql_query("DELETE FROM `book` WHERE `id` = '$id'");
			}
		}
		redirect('?');
	break;	
}

require_once 'system/tail.php';
?>