source: Administrace/AddNews.php

<?php
  include '../includes/Global.php';
  
    TestLicence('1');
  
  if (array_key_exists('Mode', $_GET)) {
    $Mode = $_GET['Mode'];
  } else {
    $Mode = '';
  }
    
  If ($Mode == '') { // formuláø pøidání aktuality
?>
  <h4>Pøidání aktuality</h4>
  <form enctype="multipart/form-data" action="AddNews.php?Mode=AddNews" method="post">
  <table border="0">
    <tr><td>Nadpis Aktuality:</td><td><input type="text" name="Name"></td></tr>
    <tr><td>Uživatel: </td><td><input type="text" name="User" value="<?php echo $_SESSION['User']; ?>"></td></tr>
    <tr><td>Popis: </td><td><input type="text" name="Description"></td></tr>
    <tr><td>Text: </td><td><textarea cols="60" name="Text" rows="20"></textarea></td></tr>
    <tr><td><input type="submit" value="Odeslat"></td></tr>
  </table>
  </form>

<?php
  }

  if ($Mode == 'AddNews') {  //pøidání aktuality
    $Name = mysql_escape_string($_POST['Name']);
    $User = mysql_escape_string($_POST['User']);
    $Description = mysql_escape_string($_POST['Description']);
    $Text = mysql_escape_string($_POST['Text']);
    echo('Jméno: '.$Name.'<br>');
    echo('Uživatel: '.$User.'<br>');
    echo('Popis: '.$Description.'<br>');
    echo('Text: '.$Text.'<br>');
    
    $sql = "SELECT max(ID) FROM news";
    $ID = $db->SQLCommand($sql);
    $Line = mysql_fetch_row($ID);
    $ID = $Line[0]+1;
    $sql = "INSERT news VALUE('$ID','$Name',now(),'$Text','$Description', '1','$User')";
      $db->SQLCommand($sql);
      WriteLog('Aktualita byla uložena: '.$Name.' ID: '.$ID.' Popis: '.$Description.' User: '.$User,'2');
      echo 'Aktualita '.$Name.' byla uložena';
  }
  
  if ($Mode == '') {  //editování aktuality
    echo '<h4>Editování aktualit</h4>';
    $sql = "SELECT * FROM news order by 3 DESC";
    $ID = $db->SQLCommand($sql);
    while($Line = mysql_fetch_array($ID)) {
      echo '<a href="AddNews.php?Mode=EditNewsForm&amp;ID='.$Line['ID'].'">'.$Line['Name'].'</a><br />';
    }   
  }


  If ($Mode == 'EditNewsForm') { // formuláø editování aktuality
    
  $ID = mysql_escape_string($_GET['ID']);

  $sql = "SELECT * FROM news WHERE ID = '$ID'";
  $ID = $db->SQLCommand($sql);
  $Line = mysql_fetch_array($ID);
?>
  <h4>Editování aktuality</h4>
  <form enctype="multipart/form-data" action="AddNews.php?Mode=EditNews" method="post">
  <input type="hidden" name="ID" value="<?php echo $Line['ID']; ?>">
  <table border="0">
    <tr><td>Nadpis Aktuality:</td><td><input type="text" name="Name" value="<?php echo $Line['Name']; ?>"></td></tr>
    <tr><td>Uživatel: </td><td><input type="text" name="User" value="<?php echo $Line['User']; ?>"></td></tr>
    <tr><td>Popis: </td><td><input type="text" name="Description" value="<?php echo $Line['Description']; ?>"></td></tr>
    <tr><td>Text: </td><td><textarea cols="60" name="Text" rows="20"><?php echo $Line['Text']; ?></textarea></td></tr>
    <tr><td><input Name="Action" type="submit" value="Editovat"></td></tr>
  </table>
  </form>

<?php
  }

  if ($Mode == 'EditNews') {  //editování aktuality
    $ID = mysql_escape_string($_POST['ID']);
      $Name = mysql_escape_string($_POST['Name']);
      $User = mysql_escape_string($_POST['User']);
      $Description = mysql_escape_string($_POST['Description']);
      $Text = mysql_escape_string($_POST['Text']);
      echo('Jméno: '.$Name.'<br>');
      echo('Uživatel: '.$User.'<br>');
      echo('Popis: '.$Description.'<br>');
      echo('Text: '.$Text.'<br>');
    
      $sql = "UPDATE news SET ID = '$ID', Name = '$Name', Text = '$Text', Description = '$Description', User = '$User' WHERE ID = '$ID'";
        $db->SQLCommand($sql);
        echo 'Aktualita '.$Name.' byla editována!';
        WriteLog('Aktualita byla editována: '.$Name.' ID: '.$ID.' Popis: '.$Description.' User: '.$User,'3');
  }

  if ($Mode == 'Del') {  //smazání aktuality
    $ID = mysql_escape_string($_GET['ID']);
  
      $sql = "DELETE from news WHERE ID = '$ID'";
        $db->SQLCommand($sql);      
        WriteLog('Aktualita byla smazána: ID='.$ID,'4');
        echo 'Aktualita '.$Name.' byla Smazána!';
  }

  ShowFooter()
?>