Besides to change all $GET[username] to $GET['username']
and all $GET[id] to $GET['id']
you can start by removing one of two sessions_start();
And add this is first line of your script
error_reporting(E_ALL); ... this is DEBUG and what we use when Coding
here is the code of index.txt
<?php
error_reporting(E_ALL); // DEBUG Mode
session_start();
if (!$_SESSION['user']) { // Corrected ['user']
// session_start(); we remove this
$_SESSION['user'] = $_POST['username']; // Correct a few bad things!
include("dbconnect.inc.php");
if ($rec = mysql_fetch_array(mysql_query("SELECT * FROM login WHERE username='$_POST[username]' AND password = '$_POST[password]'"))) {
if (($rec['username'] == $_SESSION[user]) && ($rec['password'] == $_POST[password])) {
include ("index.php");
echo "<p class=data> <center>Successfully,Logged in<br>
<br><a href=index.php>Click here if your browser is not redirecting automatically or you don't want to wait.</a><br></center>";
print "<script>";
print " self.location='index.php';";
print "</script>";
}
} else {
echo'
<html>
<body>
<div align="center">
<form method="post" action="', $PHP_SELF, '">';
echo'Username: <input type="text" name="username"><br>
Password: <input type="password" name="password"><br>
<input type="submit">
</form>
</div>
</body>
</html>';
}
} else {
echo'
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Admin Section</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style rel="stylesheet" type="text/css">
a
{
font-family: arial, sans serif;
}
a.head
{
color: #ffffff;
text-decoration: none;
}
a.head:hover
{
color: red;
}
</style>
</head>
<body>
<table width="600" border="1" bordercolor="#000000" style="border-collapse: collapse" align="center" >
<tr>
<td height="82" align="center" colspan="2"><a href="logout.php">LogOut</a> <a href="index.php">Admin Home</a></td>
</tr>
<tr>
<td align="center" colspan="2" bgcolor="blue">
<font color="#ffffff"><a class="head" href="index.php?action=homepage">Home Page</a> | <a class="head" href="index.php?action=addpage">Add Pages</a> | <a class="head" href="index.php?action=editpage">Edit Pages</a></font>
</td>
</tr>';
include("dbconnect.inc.php");
if ($_GET[action] == 'addpage' && $_POST['submit']) {
session_start();
$name = $_SESSION[user];
include("nav.php");
include("dbconnect.inc.php");
$sql = "INSERT INTO pages VALUES('','$name','$_POST[title]','$_POST[text]');";
$result = mysql_query($sql, $conn);
echo'<tr><td align=center>You have added a page</td></tr></table></body></html>';
} elseif ($_GET[action] == 'addpage') {
?> <tr>
<td align="center">
<br>
<form name="" method="post" action="index.php?action=addpage">
<p>
<input type="text" name="title"><br><br>
<textarea name="text" cols="40" rows="10"></textarea>
<p>
<input type="submit" name="submit" value="submit">
</p>
</form>
</td>
</tr>
</table>
</body>
</html>
<?php
} elseif ($_GET['action'] == 'editpage' && $_POST['submit']) {
$text = $_POST['text'];
$title = $_POST['title'];
$title_id = $_POST['title_id'];
$sql = "UPDATE pages SET content = '$text', title = '$title' WHERE username = '$_SESSION[user]' AND title = '$title_id';";
mysql_query($sql, $conn);
echo'<tr><td align=center><font color=red>successfully updated the ' . $title_id . ' page</font></td></tr></table>';
} elseif ($_GET['action'] == 'editpage') {
include("nav.php");
?>
<?php nav();
?>
<tr><td align="center" colspan="2">
<br>
<form name="" method="post" action="index.php?action=editpage">
<p>
<?php
$sql = "SELECT * from pages where username = '$_SESSION[user]' AND title='$_GET[id]'";
$result = mysql_query($sql, $conn);
$row = mysql_fetch_assoc($result);
?>
<input type="text" name="title" value="<?php echo $_GET[id];
?>"><br><br>
<!-- hidden field so that i can determin which title to update -->
<input type="hidden" name="title_id" value="<?php echo $_GET[id];
?>">
<textarea name="text" cols="40" rows="10"><?php echo $row[content];
?></textarea>
<br>
<p>
<input type="submit" name="submit" value="submit">
</form>
</td>
</tr>
</table>
</body>
</html>
<?php
} elseif ($_GET['action'] == 'homepage' && $_POST['submit']) {
$text = $_POST['text'];
$sql = "UPDATE home set content='$text' where username='$_SESSION[user]'";
$result = mysql_query($sql, $conn);
echo'<tr><td align=center><font color=red>You have succefully updated the Homepage</font></td></tr></table>';
} elseif ($_GET['action'] == 'homepage') {
?>
<tr><td align="center" colspan="2">
<br>
<form name="" method="post" action="index.php?action=homepage">
<p>
<?php
$sql = "SELECT * from home where username = '$_SESSION[user]'";
$result = mysql_query($sql, $conn);
$row = mysql_fetch_assoc($result);
?>
<textarea name="text" cols="40" rows="10"><?php echo $row[content];
?></textarea>
<br>
<p>
<input type="submit" name="submit" value="submit">
</form>
</td>
</tr>
</table>
</body>
</html>
<?php } else {
echo'<tr><td align=center>this is the admin homepage!</td></tr></table>';
}
}
?>
