source: quests/npc_save.php@ 263

<?php

  include('includes/global.php');

  // SQL injection hack protection
  foreach($_POST as $Index => $Item) $_POST[$Index] = addslashes($Item);
  foreach($_GET as $Index => $Item) $_GET[$Index] = addslashes($Item);

  if (array_key_exists('entry', $_POST)) {
    
    $entry = mysql_escape_string($_POST['entry']);  
 
    for ($i=0; $i<count($npc_text); ++$i) {
      $npc_text_save[$i] = @$_POST[$npc_text[$i]];
    }
 
    $UserID = mysql_escape_string($_SESSION['UserID']);
    $npc_ID = mysql_escape_string($_POST['ID']);
    $Language = mysql_escape_string($_POST['Language']);
    if (array_key_exists('End', $_POST))
      $complete = 1;
    else 
      $complete = 0;
          
    if (array_key_exists('Repair', $_POST) and Licence(1)) {
      $Line = mysql_fetch_array($Database->SQLCommand("SELECT user FROM npc_text Where ID = '$npc_ID'"));
      $UserID = $Line['user'];    
      $complete = 1;
      WriteLog('NPC_text: '.$entry.' Opraven moderátorem! <a href="npc_form.php?ID='.$npc_ID.'">'.$npc_ID.'</a>', 4);
    }
    
    $Line = mysql_fetch_array($Database->SQLCommand("SELECT * FROM npc_text WHERE user='$UserID' AND entry = '$entry'"));
    if (!$Line) {
      
      $sql = "INSERT INTO `npc_text` (";
      for ($i=0; $i<count($npc_text); ++$i) {
        $sql .= " `".$npc_text[$i]."` , ";
      }
      $sql .= " `Complete` , `Take` , `User` , `Vote` , `CountVote` , `Language` , `entry` ) VALUES(";
      for ($i=0; $i<count($npc_text); ++$i) {
        $sql .= "'".$npc_text_save[$i]."',";
      }
      $sql .= " '$complete' , '$npc_ID' , '$UserID' , '3' , '1' , '$Language' , '$entry')";
      
      echo 'NPC_text: '.$entry.' ulo¾en!<br />';
      WriteLog('NPC_text: '.$entry.' ulo¾en! Pøevzat z: <a href="npc_form.php?ID='.$npc_ID.'">Aj npc_text'.$npc_ID.'</a>', 6);
    } else {
      $sql = "UPDATE npc_text SET ";
      for ($i=0; $i<count($npc_text); ++$i) {
        $sql .= " ".$npc_text[$i]." = '".$npc_text_save[$i]."' , ";
      }
      $sql .= " Language = '$Language' , Complete = '$complete' , Take = '$npc_ID' , User = '$UserID' ,
      Vote = '3' , CountVote = '1' , entry = '$entry' WHERE ID = ".$npc_ID." AND Language <> 0 ";
      
      echo 'Zmìny v Npc_textu: '.$entry.' ulo¾eny!<br />';
      WriteLog('Zmìny v npc_textu: '.$entry.' ulo¾eny! 
      <a href="npc_form.php?ID='.$npc_ID.'">'.$npc_ID.'</a>', 1);
      $Database->SQLCommand("DELETE FROM `npc_vote` WHERE `npc_vote`.`IDnpc` = ".$npc_ID);
    }
      //echo $sql;
      $Database->SQLCommand($sql);
    
    echo 'Pøekládat: <a href="npc_list.php?notran">Nepøelo¾ené</a> ';
      
  }
          
  ShowFooter();      
?>