connect($mmfpm_db['addr'], $mmfpm_db['user'], $mmfpm_db['pass'], $mmfpm_db['name']);
//-------------------SQL Injection Prevention--------------------------------
$start = (isset($_GET['start'])) ? $sqlr->quote_smart($_GET['start']) : 0;
if (is_numeric($start)); else $start=0;
$order_by = (isset($_GET['order_by'])) ? $sqlr->quote_smart($_GET['order_by']) : 'id';
if (preg_match('/^[_[:lower:]]{1,15}$/', $order_by)); else $order_by='id';
$dir = (isset($_GET['dir'])) ? $sqlr->quote_smart($_GET['dir']) : 1;
if (preg_match('/^[01]{1}$/', $dir)); else $dir=1;
$order_dir = ($dir) ? 'ASC' : 'DESC';
$dir = ($dir) ? 0 : 1;
//-------------------Search--------------------------------------------------
$search_by = '';
$search_value = '';
// if we have a search request, if not we just return everything
if(isset($_GET['search_value']) && isset($_GET['search_by']))
{
// injection prevention
$search_value = $sqlr->quote_smart($_GET['search_value']);
$search_by = $sqlr->quote_smart($_GET['search_by']);
$search_menu = array('username', 'id', 'gmlevel', 'greater_gmlevel', 'email', 'joindate', 'last_ip', 'failed_logins', 'last_login', 'active_realm_id', 'banned', 'locked', 'expansion');
if (in_array($search_by, $search_menu));
else $search_by = 'username';
unset($search_menu);
// special search cases
// developer note: 'if else' is always faster then 'switch case'
if ($search_by === 'greater_gmlevel')
{
$sql_query = 'SELECT id,username,gmlevel,email,joindate,last_ip,failed_logins,locked,last_login,active_realm_id,expansion
FROM account WHERE gmlevel > "%'.$search_value.'%" ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
$query_1 = $sqlr->query('SELECT count(*) FROM account WHERE gmlevel > "%'.$search_value.'%"');
}
elseif ($search_by === 'banned')
{
$sql_query = 'SELECT id,username,gmlevel,email,joindate,last_ip,failed_logins,locked,last_login,active_realm_id,expansion
FROM account WHERE id = 0 ';
$count_query = 'SELECT count(*) FROM account WHERE id = 0 ';
$que = $sqlr->query('SELECT id FROM account_banned');
while ($banned = $sqlr->fetch_assoc($que))
{
$sql_query .= 'OR id = '.$banned['id'].'';
$count_query .= 'OR id = '.$banned['id'].'';
}
$sql_query .= ' ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
$query_1 = $sqlr->query($count_query);
unset($count_query);
}
elseif ($search_by === 'failed_logins')
{
$sql_query = 'SELECT id,username,gmlevel,email,joindate,last_ip,failed_logins,locked,last_login,active_realm_id,expansion
FROM account WHERE failed_logins > '.$search_value.' ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
$query_1 = $sqlr->query('SELECT count(*) FROM account WHERE failed_logins > '.$search_value.'');
}
else
{
// default search case
$sql_query = 'SELECT id,username,gmlevel,email,joindate,last_ip,failed_logins,locked,last_login,active_realm_id,expansion
FROM account WHERE '.$search_by.' LIKE "%'.$search_value.'%" ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
$query_1 = $sqlr->query('SELECT count(*) FROM account WHERE '.$search_by.' LIKE "%'.$search_value.'%"');
}
$query = $sqlr->query($sql_query);
}
else
{
// get total number of items
$query_1 = $sqlr->query('SELECT count(*) FROM account');
$query = $sqlr->query('SELECT id,username,gmlevel,email,joindate,last_ip,failed_logins,locked,last_login,active_realm_id,expansion
FROM account ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'');
}
// this is for multipage support
$all_record = $sqlr->result($query_1,0);
unset($query_1);
//==========================top tage navigaion starts here========================
// we start with a lead of 10 spaces,
// because last line of header is an opening tag with 8 spaces
// keep html indent in sync, so debuging from browser source would be easy to read
$output .='