Post 2/2
if($_GET['page'] == "messages") // Displaying of content works.. adding and editing doesnt
{
$pagetitle = "Manage Messages";
$output = "This page is for managing your messages. You may add, edit, or delete them. Choose an appropriate graphic that corresponds to what you'd like to do.\n"
."<table width=\"100%\" border=\"1\" bgcolor=\"#ffffff\">\n"
."<tr align=\"center\">\n"
."<td><b>ID</b></td>\n"
."<td><b>Name</b></td>\n"
."<td style=\"width: 30px;\"><b>Edit</b></td>\n"
."<td style=\"width: 30px;\"><b>Delete</b></td>\n"
."</tr>\n";
$sql = "SELECT * FROM ".TABLE_MESSAGES." ORDER BY ID ASC";
if($exe = mysql_query($sql))
{
while($row = mysql_fetch_array($exe))
{
$row['editlink'] = "<a href=\"".$_SERVER['PHP_SELF']."?page=messages&action=edit&wid=".$row['ID']."\"><img style=\"width: 25px; height: 25px;\" src=\"edit.png\" /></a>";
$row['deletelink'] = "<a href=\"".$_SERVER['PHP_SELF']."?page=messages&action=delete&wid=".$row['ID']."\"><img style=\"width: 25px; height: 25px;\" src=\"delete.png\" /></a>";
$output .= "<tr>\n"
."<td>".$row['ID']."</td>\n"
."<td>".stripslashes($row['name'])."</td>\n"
."<td>".$row['editlink']."</td>\n"
."<td>".$row['deletelink']."</td>\n"
."</tr>\n";
}
}
$output .= "</table><br /><br />\n"
."<a href=\"".$_SERVER['PHP_SELF']."?page=messages&action=add\"><img style=\"width: 25px; height: 25px;\" src=\"add.png\" /> Add New</a>\n";
if($_GET['action'] == "add") // Script doesn't execute, Submit button sends you to the main page.
{
$output = "<form action=\"http://".$_SERVER['SERVER_NAME'].$_SERVER['SCRIPT_NAME']."\" method=\"post\">\n"
."<b>Name:</b> <input type=\"text\" name=\"name\" value=\"\" />\n"
."<input type=\"hidden\" name=\"do\" value=\"process\" />\n"
."<input type=\"submit\" />\n"
."</form>";
if($_POST['do'] == "process") // Gets Skipped
{
$sql = "INSERT INTO ".TABLE_MESSAGES." (name) VALUES ('".addslashes($_POST['name'])."')";
if($exe = mysql_query($sql))
{
$output = $_POST['name']." successfully added to the messages.\n";
}
}
}
if($_GET['action'] == "edit") // Script doesn't execute, Submit button sends you to the main page.
{
$sql = "SELECT * FROM ".TABLE_MESSAGES." WHERE ID = '".$_GET['wid']."'";
$row = mysql_fetch_array(mysql_query($sql));
$output = "<form action=\"http://".$_SERVER['SERVER_NAME'].$_SERVER['SCRIPT_NAME']."\" method=\"post\">\n"
."<b>Name:</b> <input type=\"text\" name=\"name\" value=\"".stripslashes($row['name'])."\" />\n"
."<input type=\"hidden\" name=\"do\" value=\"process\" />\n"
."<input type=\"submit\" />\n"
."</form>\n";
if($_POST['do'] == "process") // Gets skipped
{
$sql = "UPDATE ".TABLE_MESSAGES." SET name = '".addslashes($_POST['name'])."' WHERE ID = '".$_GET['wid']."'";
if($exe = mysql_query($sql))
{
$output = $_POST['name']." successfully updated.\n";
}
}
}
if($_GET['action'] == "delete") // Works.
{
$sql = "DELETE FROM ".TABLE_MESSAGES." WHERE ID = '".$_GET['wid']."'";
if($exe = mysql_query($sql))
{
$output = $_POST['name']." successfully removed from the messages.\n";
}
}
}
if($_GET['page'] == "status") // Script doesn't execute, Submit button sends you to the main page. Radio buttons don't display what is selected.
{
$pagetitle = "Manage Status";
$sql = "SELECT ID, status FROM ".TABLE_SETTINGS." WHERE ID = '1'";
$row = mysql_fetch_array(mysql_query($sql));
$row['status'] = $s;
$output = "This page is for managing the readerboard status.<br /><br />\n"
."<b>Readerboard Status:</b><br />\n"
."<form action=\"http://".$_SERVER['SERVER_NAME'].$_SERVER['SCRIPT_NAME']."\" method=\"post\">\n"
."<input type=\"radio\" name=\"stat\" value=\"1\" ";
if($s == "1")
{
$output .= "selected=\"selected\"";
}
$output .= "/> Enabled\n"
."<input type=\"radio\" name=\"stat\" value=\"0\" ";
if($s == "0")
{
$output .= "selected=\"selected\"";
}
$output .= "/> Disabled \n"
."<input type=\"hidden\" name=\"do\" value=\"process\" /><br /><br />\n"
."<input type=\"submit\" />\n"
."</form>\n";
if($_POST['do'] == "process") // Gets skipped
{
$sql = "UPDATE ".TABLE_SETTINGS." SET status = '".$_POST['stat']."'";
if($exe = mysql_query($sql))
{
$output = "Query Successful.\n";
}
}
}
if($_GET['page'] == "stylesheet") // Script doesn't execute, Submit button sends you to the main page.
{
$pagetitle = "Manage Stylesheet";
$output = "This page is for managing your stylesheet and banner. Don't edit the stylesheet unless you are experienced with the code.\n";
$sql = "SELECT stylesheet FROM ".TABLE_SETTINGS;
$row = mysql_fetch_array(mysql_query($sql));
$output .= "<form action=\"http://".$_SERVER['SERVER_NAME'].$_SERVER['SCRIPT_NAME']."\" method=\"post\">\n"
."<textarea style=\"width: 90%; height: 200px;\" name=\"stylesheet\" value=\"\">".$row['stylesheet']."</textarea><br /><br />\n"
."<input type=\"hidden\" name=\"do\" value=\"process\" />\n"
."<input type=\"submit\" />\n";
if($_POST['do'] == "process") // Gets skipped
{
$sql = "UPDATE ".TABLE_SETTINGS." SET stylesheet = '".$_POST['stylesheet']."'";
if($exe = mysql_query($sql))
{
$output = "Stylesheet successfully updated.\n";
}
}
}
if(($_GET['page'] == "") || (!$_GET['page'])) // When the Submit button is pressed, everything seems to come here...
{
$pagetitle = "Management Page";
$output = "Welcome to the Readerboard management page. Please choose an option to your left.<br /><br />\n"
."<b>Manage Content:</b><br />\n"
."Allows you to add, edit, or delete any piece of main content. Also includes a format bar to edit various information (and include pictures).<br /><br />\n"
."<b>Manage Messages:</b><br />\n"
."Allows you to add, edit, or delete the messages at the office for people. Also includes a color bar to edit the color of the text.<br /><br />\n"
."<b>Manage Status:</b><br />\n"
."Allows you to edit whether or not the readerboard is live.<br /><br />\n"
."<b>Manage Stylesheet:</b><br />\n"
."Allows you to edit the banner and style of the readerboard.\n";
}
$pagecontents = $output;
include("layout.php");
?>
The URL of the script when I click submit (this example will be for page=content) is not what it should be.
The URL displays like this (which is also likely the reason it's displaying the main page):
admin.manage.php?title=fasdfgasg&body=sfasdfasd&do=process
Instead of:
admin.manage.php?page=content&do=process
Which must be a bit of a security flaw, but alas, even after adding a hidden tag at the top of the form instructing it to go to page=content, the script still doesn't work.
Also, changing the form action to $_SERVER['PHP_SELF'] doesn't help.
This problem has just completely mindboggled me. I can't even figure out what it might be.
Thanks a bunch!
