source: quests/client_save.php@ 301

<?php

  include('includes/global.php');

  // SQL injection hack protection
  foreach($_POST as $Index => $Item) $_POST[$Index] = addslashes($Item);
  foreach($_GET as $Index => $Item) $_GET[$Index] = addslashes($Item);

  //ochrana proti neoprávnìnému pøístupu
  if (Licence(0) == false) { die('Nemáte pøístup do této sekce! Pøihlašte se...'); }

  if (array_key_exists('entry', $_POST)) {
    
    $entry = mysql_escape_string($_POST['entry']);  
 
    for ($i=0; $i<count($client_text); ++$i) {
      $client_text_save[$i] = @$_POST[$client_text[$i]];
    }
 
    $UserID = mysql_escape_string($_SESSION['UserID']);
    $id_text = mysql_escape_string($_POST['id_text']);
    $client_ID = mysql_escape_string($_POST['ID']);
    $Language = mysql_escape_string($_POST['Language']);
    if (array_key_exists('End', $_POST))
      $complete = 1;
    else 
      $complete = 0;
          
    if (array_key_exists('Repair', $_POST) and Licence(1)) {
      $Line = mysql_fetch_array($Database->SQLCommand("SELECT user FROM client_text Where ID = '$client_ID'"));
      $UserID = $Line['user'];    
      $complete = 1;
      WriteLog('client_text: '.$entry.' Opraven moderátorem! <a href="client_form.php?ID='.$client_ID.'">'.$client_ID.'</a>', 4);
    }
    
    $Line = mysql_fetch_array($Database->SQLCommand("SELECT * FROM client_text WHERE user='$UserID' AND entry = '$entry'"));
    if (!$Line) {
      
      $sql = "INSERT INTO `client_text` (";
      for ($i=0; $i<count($client_text); ++$i) {
        $sql .= " `".$client_text[$i]."` , ";
      }
      $sql .= " `Complete` , `Take` , `User` , `Vote` , `CountVote` , `Language` , `entry` , `id_text`) VALUES(";
      for ($i=0; $i<count($client_text); ++$i) {
        $sql .= "'".$client_text_save[$i]."',";
      }
      $sql .= " '$complete' , '$client_ID' , '$UserID' , '3' , '1' , '$Language' , '$entry' , '$id_text')";
      
      echo 'client_text: '.$entry.' ulo¾en!<br />';
      WriteLog('client_text: '.$entry.' ulo¾en! Pøevzat z: <a href="client_form.php?ID='.$client_ID.'">Aj client_text'.$client_ID.'</a>', 8);
    } else {
      $sql = "UPDATE client_text SET ";
      for ($i=0; $i<count($client_text); ++$i) {
        $sql .= " ".$client_text[$i]." = '".$client_text_save[$i]."' , ";
      }
      $sql .= " Language = '$Language' , Complete = '$complete' , Take = '$client_ID' , User = '$UserID' ,
      Vote = '3' , CountVote = '1' , entry = '$entry' WHERE ID = ".$client_ID." AND Language <> 0 ";
      
      echo 'Zmìny v client_textu: '.$entry.' ulo¾eny!<br />';
      WriteLog('Zmìny v client_textu: '.$entry.' ulo¾eny! 
      <a href="client_form.php?ID='.$client_ID.'">'.$client_ID.'</a>', 8);
      $Database->SQLCommand("DELETE FROM `client_vote` WHERE `client_vote`.`IDclient` = ".$client_ID);
    }
      //echo $sql;
      $Database->SQLCommand($sql);
    
    echo 'Pøekládat: <a href="client_list.php?notran">Nepøelo¾ené</a> ';
      
  }
          
  ShowFooter();      
?>