Bravo List - Shoutbox

Code:

/*****************************



Hannes' ShoutBox v1.0



*****************************/



require_once("include/bittorrent.php");

dbconn(false);



loggedinorreturn();



//deleting messages



if (isset($_GET['del']))

{

if (is_numeric($_GET['del']))

{

$query = "SELECT * FROM shoutbox WHERE id=".$_GET['del'];

$result = mysql_query($query);

}

else {echo "invalid msg id STOP TRYING TO INJECT SQL TIT HEAD";exit;

}



$row = mysql_fetch_row($result);



if ( (get_user_class() >= UC_MODERATOR) )

{

$query = "DELETE FROM shoutbox WHERE id=".$_GET['del'];

mysql_query($query);

}

}

// EDIT SHOUT ?

if (isset($_GET['edit']) && get_user_class() >= UC_MODERATOR && is_valid_id($_GET['edit']))

{        

        $sql=sql_query("SELECT id,text FROM shoutbox WHERE id=".sqlesc($_GET['edit']));

        $res=mysql_fetch_array($sql);

        ?>

        

        

        

        

        

        

        

        

        

        
        echo '';

        echo '';

        echo ''.htmlspecialchars($res['text']).'';

        echo '';

        echo '
';

        die;

}

// UPDATE SHOUT?

if (isset($_POST['text']) && get_user_class() >= UC_MODERATOR && is_valid_id($_POST['id']))

{

        $text = trim($_POST['text']);

        $id = (int)$_POST['id'];

        if (isset($text) && isset($id) && is_valid_id($id))

                sql_query("UPDATE shoutbox SET text = ".sqlesc($text)." WHERE id=".sqlesc($id));

}



?>



Klepetalnica
















/*

if ($CURUSER["chatpost"] == 'no')

{

print("

You are banned.
");

exit;

}

else

{

*/



if($_GET["sent"]=="yes")

{

$userid=$CURUSER["id"];

$username=$CURUSER["username"];

$date=time();

$text=trim($_GET["shbox_text"]);



mysql_query("INSERT INTO shoutbox (id, userid, username, date, text) VALUES ('id'," . sqlesc($userid) . ", " . sqlesc($username) . ", $date, " . sqlesc($text) . ")") or sqlerr(__FILE__, __LINE__);

}



$res = mysql_query("SELECT * FROM shoutbox ORDER BY date DESC LIMIT 35") or sqlerr(__FILE__, __LINE__);

if (mysql_num_rows($res) == 0)

print("\n");

else

{

print("\n");


while ($arr = mysql_fetch_assoc($res))

{

$res2 = mysql_query("SELECT username,class,avatar,donor, title,enabled,warned FROM users WHERE id=$arr[userid]") or sqlerr(__FILE__, __LINE__);

$arr2 = mysql_fetch_assoc($res2);

$resowner = mysql_query("SELECT id, username, class FROM users WHERE id=$arr[userid]") or print(mysql_error());

$rowowner = mysql_fetch_array($resowner);



if ($rowowner["class"] == "96")

$usercolor= "" .htmlspecialchars($rowowner["username"]). "";

elseif ($rowowner["class"] == "80")

$usercolor= "" .htmlspecialchars($rowowner["username"]). "";

elseif ($rowowner["class"] == "64")

$usercolor= "" .htmlspecialchars($rowowner["username"]). "";

elseif ($rowowner["class"] == "48")

$usercolor= "" .htmlspecialchars($rowowner["username"]). "";

elseif ($rowowner["class"] == "32")

$usercolor= "" .htmlspecialchars($rowowner["username"]). "";

elseif ($rowowner["class"] == "16")

$usercolor= "" .htmlspecialchars($rowowner["username"]). "";

elseif ($rowowner["class"] == "0")

$usercolor= "" .htmlspecialchars($rowowner["username"]). "";


if (get_user_class() >= UC_MODERATOR) {

$del="[Izbrisi]";

$edit="[Uredi]\n";

}

$pm = "[Pm]\n";

print("\n");

}

print("



|".strftime("%H:%M",$arr["date"])."|

$del$edit$pm  



$usercolor" .

($arr2["donor"] == "yes" ? "[img].[/img]" : "") .

($arr2["class"] == "96" ? "[img].[/img]" : "") .

($arr2["class"] == "80" ? "[img].[/img]" : "") .

($arr2["class"] == "64" ? "[img].[/img]" : "") .

($arr2["class"] == "48" ? "[img].[/img]" : "") .

($arr2["class"] == "32" ? "[img].[/img]" : "") .

($arr2["class"] == "16" ? "[img].[/img]" : "") .

($arr2["class"] == "0" ? "[img].[/img]" : "") .

($arr2["warned"] == "yes" ? "[img].[/img]" : "") .

" ".format_comment($arr["text"])."

");





}





?>