Here's the codes so you don't have to follow the link.
Admin.php
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Flash News System</title>
<link href="style.css" type="text/css" rel="stylesheet" />
</head>
<body>
<h3 style="text-align:center;">News System</h3>
<div id="nav" style="position:relative;left:40%;">
<ul>
<li><a href="admin.php">Home</a></li>
<li><a href="admin.php?mode=add">Add News</a></li>
</ul>
</div>
<div style="position:relative;top:70px;">
<?php
define('flash_news' , TRUE);
include('admin/functions.php');
connect('root', '', 'test', 'localhost');
//define variables
$mode = ( isset( $_POST['mode'] ) ) ? $_POST['mode'] : ( ( isset( $_GET['mode'] ) ) ? $_GET['mode'] : '' );
$action = ( isset( $_POST['action'] ) ) ? $_POST['action'] : ( ( isset( $_GET['action'] ) ) ? $_GET['action'] : '' );
$id = ( isset( $_GET['id'] ) ) ? intval($_GET['id']) : ( (isset($_POST['id'] ) ) ? intval($_POST['id'] ) : '' );
//What needs to be done?
if( $mode != '' ){
switch($mode){
case 'add' :
case 'edit' :
include( 'admin/actions.php');
break;
case 'delete' :
//DELETE NEWS ENTRY
$query = 'DELETE FROM flash_news
WHERE id = ' . $id ;
if(mysql_query($query)){
echo 'Delete Successful!';
}else{
echo 'Could Not Delete News..' . mysql_error();
}
break;
//DEFAULT TO INVALID
default :
echo 'Invalid Request';
}
}else{
//LIST ALL NEWS ENTRIES FOR US TO VIEW
$query = 'SELECT id, title , FROM_UNIXTIME(timestamp, \'%M %D %Y \') date FROM flash_news';
$result = mysql_query($query);
echo '<table style="margin: 0 auto;width:500px;border: 1px dotted #E5E5E5;" cellpadding="5" cellspacing="1">
<tr>
<th>Title</th><th>Published</th><th>Edit</th><th>Delete</th>';
while($r = mysql_fetch_array($result)){
//Swap our CSS classes
$bg = 'light' ? 'light' : 'dark';
echo '
<tr class="' . $bg . '"><td><strong>' . stripslashes2($r['title']) . '</strong></td>
<td>' . $r['date'] . '</td>
<td><a href="admin.php?mode=edit&id=' . $r['id'] . '">Edit</a></td>
<td><a href="admin.php?mode=delete&id=' . $r['id'] .'">Delete</a></td></tr>';
}
echo '</table>';
}
?>
</div>
</body>
</html>
--------------------------------------------------------------------------
XML.PHP
<?php
#***********************************
# XML OUTPUT
#***********************************
include('admin/functions.php');
connectconnect('root', '', 'test', 'localhost');
$query = 'SELECT id, author, title, body, FROM_UNIXTIME(timestamp, \'%M %D %Y\') date
FROM flash_news
LIMIT 1000';
$result = mysql_query($query);
$nl = "\r\n";
echo '<?xml version="1.0" encoding="ISO-8859-1"?>' . $nl;
echo '<ROOT>' . $nl;
while($r = mysql_fetch_array($result)){
echo '<news id="' . $r['id'] . '" title="' . stripslashes2($r['title']) . '" date="' . $r['date'] . '" author="' . stripslashes2($r['author']) . '">' . $nl;
echo '<body><![CDATA[' . stripslashes2($r['body']) . ']]></body>' . $nl;
echo '</news>' . $nl;
}
echo '</ROOT>' . $nl;
?>
----------------------------------------------------------------------------
ACTIONS.PHP
<?php
#***********************
# ADD AND EDIT NEWS ENTRY
#***********************
//Check to make sure nobody attempts to access file directly
if(!defined('flash_news')){
echo 'You do not have permission to access this file';
exit;
}
$author = (isset($_POST['author'])) ? $_POST['author'] : '';
$title = (isset($_POST['title'])) ? $_POST['title'] : '';
$body = (isset($_POST['body'])) ? $_POST['body'] : '';
//ADD NEWS ENTRY
if($mode != '' && $action === 'add_news'){
//Did they fill in everything?
if($author != '' && $title != '' && $body != ''){
//YES
$query = "INSERT INTO flash_news (author, title, body, timestamp)
VALUES('" . $author . "', '" . $title . "', '" . $body . "', '" . time() . "')";
if(mysql_query($query)){
echo 'News Added!';
}else{
echo 'Problem Executing Query - ' . mysql_error();
}
}else{
//NO
echo 'Please Fill in all fields!';
}
}elseif($mode === 'edit'){
if($action == ''){
$query = 'SELECT id, author, title , body
FROM flash_news
WHERE id=' . $id . '';
$result = mysql_query($query);
$r = mysql_fetch_row($result);
$id = $r[0];
$author = stripslashes2($r[1]);
$title = stripslashes2($r[2]);
$body = stripslashes2($r[3]);
}else{
if($action === 'edit_news'){
$query = 'UPDATE flash_news
SET author="' . $author . '", title="' . $title . '", body="' . $body . '"
WHERE id =" ' . $id . '"';
if(mysql_query($query)){
echo 'Update Successful!';
}else{
echo 'Could not update News..' . mysql_error();
}
}
}
}
?>
<div style="margin-top: 150px;">
<table style="margin: 0 auto;width:500px;top:50px;border:1px dotted #E5E5E5;" cellspacing="1">
<tr class="dark">
<td><form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">Author</td>
<td><input type="text" name="author" value="<?php echo $author; ?>" style="width: 120px;" /></td>
</tr>
<tr class="light">
<td>Title</td>
<td><input type="text" name="title" value="<?php echo $title; ?>" style="width: 120px;" /></td>
</tr>
<tr class="dark">
<td>Body:</td>
<td><textarea name="body" cols="40" rows="10"><?php echo $body; ?></textarea></td>
</tr>
<tr class="light">
<td colspan="2">
<input type="hidden" value="<?php echo $mode; ?>" name="mode" />
<input type="hidden" value="<?php echo $id; ?>" name="id" />
<input type="hidden" value="<?php echo ($mode == 'add' ? 'add_news' : 'edit_news'); ?>" name="action" />
<input type="submit" value="Submit" name="submit" class="button" />
</td>
</tr>
</form>
</table>
</div>
-------------------------------------------------------------------------------
FUNCTIONS.PHP
<?php
#********************************
# COMMON FUNCTION FILE
#********************************
//Connect to our database
function connect($dbuser, $dbpass, $dbname, $dbhost){
mysql_connect($dbhost , $dbuser, $dbpass) || die('Can not connect to db' .
mysql_error());
mysql_select_db($dbname) || die('Can not select db' . mysql_error());
return;
}
//Add backslashes only to \ and '
function addslashes2( $string )
{
$string = str_replace( '\\', '\\\\', $string );
return str_replace( '\'', '\\\'', $string );
}
//Stripslashes from string if get_magic_quotes_gpc is on
function stripslashes2( $string )
{
return ( get_magic_quotes_gpc() ) ? stripslashes( $string ) : $string;
}
?>
