'."\n"; if ($search) { $page .= '

'."\n"; $page .= '

No articles found.

Try searching again, or return to the main page. The search is case-insensitive, and searches the title, author, date, and the text of each article.

'."\n"; $page .= '

'."\n"; } else { $page .= '

'."\n"; $page .= '

No articles found.

'; $page .= '

'."\n"; } $page .= '

'."\n"; return $page; } $page .= '

'."\n"; foreach ($result as $entry) { if (empty($entry['id']) && isset($_SESSION['allow_queue_image'])) { $entry['id'] = $_SESSION['allow_queue_image']; } if ($entry['date']) $date = '' . $entry['date'] . ''; $page .= '

'; $page .= '

'; if ($is_admin && !$editable) { $page .= '[edit]'; } $page .= '

'; if ($nolink) { $page .= $entry['title']; } else if ($is_admin && $editable) { $page .= ''; $page .= $entry['title']; $page .= ''; } else { $page .= ''; $page .= $entry['title']; $page .= ''; } $page .= '

'; $page .= '

By: ' . $entry['author'] . '
Posted: ' . $date . '

'; if (isset($file_src)) { $page .= ' '.$entry['title'].'

'; } else if (!empty($entry['img']) || !empty($entry['uploaded'])) { if ($editable) { $page .= ' '.$entry['title'].'

'; } else { $page .= ' '.$entry['title'].'

'; } } else { $page .= $entry['story']."\n"; } $page .= "

\n"; } $page .= '

'."\n"; if (count($result) > 1) $page .= get_pager(); return $page; } /* * Return number of entries matching our request */ function get_count() { global $db, $is_admin; $search = get_search_args(); $queue = get_queue(); $table = which_table(); // if search= is defined, search.... if ($search) { $count_query = "SELECT COUNT(*) FROM $table WHERE". " ( title LIKE '%".$search."%'". " OR author LIKE '%".$search."%'". " OR date LIKE '%".$search."%'". " OR story LIKE '%".$search."%'". " )"; // Otherwise, fall back to default view } else { $count_query = "SELECT COUNT(*) FROM ".$table." WHERE 1"; } if (!$is_admin && !$queue) $count_query .= " AND hidden IS NOT TRUE"; $count_query .= " ;"; //echo $count_query."
"; $row_count = NULL; echo $db->info; if ($count_query) { if ($result = $db->query($count_query)) { $row_count = $result->fetch_row(); $result->close(); } else { die("Error in query: $db->error"); } } return $row_count[0]; } /* * Return array of results, correctly keyed to column names. */ function get_query($id = NULL) { global $db, $is_admin; $search = get_search_args(); $sort = get_sort_arg(); $order = get_order(); $start = get_start_num(); $show = get_show_num(); $queue = get_queue(); $table = which_table(); $results = array(); // If id= is defined, show the corresponding application only if (is_numeric($id)) { if (!$is_admin && !$queue) $query = "SELECT * FROM $table WHERE 1 AND hidden IS NOT TRUE AND id = ".$id." LIMIT 0, 1"; else $query = "SELECT * FROM $table WHERE 1 AND id = ".$id." LIMIT 0, 1"; // if search= is defined, search.... } else if ($search) { $query = "SELECT * FROM $table WHERE". " ( title LIKE '%".$search."%'". " OR author LIKE '%".$search."%'". " OR date LIKE '%".$search."%'". " OR story LIKE '%".$search."%'". " )"; if (!$is_admin && !$queue) $query .= " AND hidden IS NOT TRUE"; $query .= " ORDER BY ".$sort." " .$order." LIMIT " .$start." , ".$show." ;"; // Otherwise, fall back to default view } else { $query = "SELECT * FROM ".$table." WHERE 1"; if (!$is_admin && !$queue) $query .= " AND hidden IS NOT TRUE"; $query .= " ORDER BY ".$sort." " .$order." LIMIT " .$start." , ".$show." ;"; } //echo $query; if ($result = $db->query($query)) { while ($row = $result->fetch_assoc()) { $row['queue_url'] = $queue ? 1 : 0; $results[] = $row; } $result->close(); } else { die("Error in query: $db->error"); } return $results; } /* * Return array of the POST variables we may care about * (safer than extract($_POST)) * * If $stripslashes is non-null, run stripslashes on the values * Note that stripslashes turns NULL into string("") * and int(0) into string("0") * * If $html is non-null, run the output through htmlspecialchars, * to translate HTML-unsafe characters. This should only be needed * if you're outputting back to an HTML form. */ function get_post_data($stripslashes = NULL, $html = NULL) { $queue = get_queue(); $results = array(); $entry['id'] = isset($_POST['id']) ? $_POST['id'] : NULL; $entry['title'] = isset($_POST['title']) ? $_POST['title'] : NULL; $entry['author'] = isset($_POST['author']) ? $_POST['author'] : NULL; $entry['email'] = isset($_POST['email']) ? $_POST['email'] : NULL; $entry['upload'] = isset($_POST['upload']) ? $_POST['upload'] : NULL; $entry['story'] = isset($_POST['story']) ? $_POST['story'] : NULL; $entry['comments'] = isset($_POST['comments']) ? $_POST['comments'] : NULL; $entry['date'] = isset($_POST['date']) ? $_POST['date'] : NULL; $entry['hidden'] = isset($_POST['hidden']) ? $_POST['hidden'] : NULL; $entry['uploaded'] = isset($_POST['uploaded']) ? $_POST['uploaded'] : NULL; $entry['editor'] = isset($_POST['editor']) ? $_POST['editor'] : NULL; $entry['remove_img'] = isset($_POST['remove_img']) ? ($_POST['remove_img'] ? 1 : 0) : NULL; $entry['queue_url'] = $queue ? 1 : 0; if ($stripslashes) { $entry = array_map('stripslashes', $entry); } if ($html) { $entry = array_map('map_html', $entry); } $results[] = $entry; return $results; } function map_html($string) { return htmlspecialchars($string, ENT_QUOTES, 'UTF-8', FALSE); } function unmap_html($string) { return htmlspecialchars_decode($string, ENT_QUOTES); } /* * Utility functions to sanitise data */ function get_id() { global $db, $id; if (is_numeric($id)) { return $id; } else if (isset($_REQUEST['id']) && is_numeric($_REQUEST['id'])) { $id = $db->real_escape_string(stripslashes($_REQUEST['id'])); return $id; } else { return NULL; } } function get_search_args() { global $db; if (isset($_GET['search'])) { $search = $db->real_escape_string($_GET['search']); return $search; } } function get_order() { global $db; $order = NULL; if (isset($_GET['order'])) { $order = $db->real_escape_string($_GET['order']); } // Sort ascending by default if ($order != "ASC" && $order != "DESC" && $order != "asc" && $order != "desc") if (get_sort_arg() == "date") { $order = "desc"; } else $order = "asc"; return $order; } function get_sort_arg() { global $db; $sort = NULL; if (isset($_GET['sort'])) { $sort = $db->real_escape_string($_GET['sort']); } if ($sort != "author" && $sort != "date" && $sort != "title") $sort = "date"; return $sort; } function get_show_num() { global $db, $num_stories; $show = NULL; if (isset($_GET['show'])) { $show = $db->real_escape_string($_GET['show']); } if (is_numeric($show)) return $show; else if ($num_stories) return $num_stories; else // provide fallback return 1; } function get_start_num() { global $db; $start = NULL; if (isset($_GET['start'])) { $start = $db->real_escape_string($_GET['start']); } if (!is_numeric($start)) $start = 0; return $start; } /* * Return the queue */ function get_queue() { global $action, $queue; if ($action == 'save' || $action == 'submit') $queue = TRUE; else if (isset($_REQUEST['queue'])) $queue = ($_REQUEST['queue'] === '1') ? TRUE : FALSE; else if (!is_bool($queue)) $queue = FALSE; return $queue; } /* * Returns the table name */ function which_table($move = FALSE, $action = 'read') { global $is_admin; $queue = get_queue(); // Editing if ($action == 'delete' && $move && $is_admin) { return 'queue'; } else if ($action == 'post' && $is_admin) { return 'xxx'; } else if ($action == 'save' || $action == 'submit') { return 'queue'; // Viewing } else if ($queue && ($is_admin || array_key_exists('allow_queue_image', $_SESSION))) { return 'queue'; } else { return 'xxx'; } }