'."\n";
$page .= 'No articles found.
Try searching again, or return to the main page. The search is case-insensitive, and
searches the title, author, date, and the text of each article.
'."\n";
$page .= ''."\n";
} else {
$page .= ''."\n";
$page .= '
No articles found.
';
$page .= '
'."\n";
foreach ($result as $entry) {
if (empty($entry['id']) && isset($_SESSION['allow_queue_image'])) {
$entry['id'] = $_SESSION['allow_queue_image'];
}
if ($entry['date'])
$date = '';
$page .= '- ';
$page .= '';
if ($is_admin && !$editable) {
$page .= '[edit]';
}
$page .= '';
$page .= '
';
if ($entry['hidden'])
$page .= '[hidden]';
$page .= '- By
- ' . $entry['author'] . '
';
$page .= '- Posted
- ' . $date . '
';
$page .= '
';
if (isset($file_src)) {
$page .= '!['.$entry['title'].']('.$file_src.')
';
} else if (!empty($entry['img']) || !empty($entry['uploaded'])) {
if ($editable) {
$page .= '!['.$entry['title'].'](/display?id='.$entry['id'].'&queue='.$entry['queue_url'].')
';
} else {
$page .= '!['.$entry['title'].'](/display?id='.$entry['id'].')
';
}
} else {
$page .= $entry['story']."\n";
}
$page .= "\n \n";
}
$page .= '
'."\n";
if (count($result) > 1)
$page .= get_pager();
return $page;
}
/*
* Return number of entries matching our request
*/
function get_count() {
global $db, $is_admin;
$search = get_search_args();
$queue = get_queue();
$table = which_table();
$params = array();
// if search= is defined, search....
if ($search) {
$count_query = "SELECT COUNT(*) FROM $table WHERE".
" (title LIKE ? OR author LIKE ? OR date LIKE ? OR story LIKE ?)";
$params = array_fill(0, 4, "%$search%");
// Otherwise, fall back to default view
} else {
$count_query = "SELECT COUNT(*) FROM ".$table." WHERE 1";
}
if (!$is_admin)
$count_query .= " AND hidden IS NOT TRUE";
//echo $count_query."
";
$row_count = NULL;
echo $db->info;
if ($count_query) {
if ($result = $db->execute_query($count_query, $params)) {
$row_count = $result->fetch_row();
$result->close();
} else {
die("Error in query: $db->error");
}
}
return $row_count[0];
}
/*
* Return array of results, correctly keyed to column names.
*/
function get_query($id = NULL) {
global $db, $is_admin;
$search = get_search_args();
$sort = get_sort_arg();
$order = get_order();
$start = get_start_num();
$show = get_show_num();
$queue = get_queue();
$table = which_table();
$results = array();
$params = array();
$limit = " LIMIT ".(int)$start." , ".(int)$show;
// If id= is defined, show the corresponding application only
if (is_numeric($id)) {
if (!$is_admin)
$query = "SELECT * FROM $table WHERE 1 AND hidden IS NOT TRUE AND id = ".(int)$id." LIMIT 0, 1";
else
$query = "SELECT * FROM $table WHERE 1 AND id = ".(int)$id." LIMIT 0, 1";
// if search= is defined, search....
} else if ($search) {
$query = "SELECT * FROM $table WHERE".
" (title LIKE ? OR author LIKE ? OR date LIKE ? OR story LIKE ?)";
$params = array_fill(0, 4, "%$search%");
if (!$is_admin)
$query .= " AND hidden IS NOT TRUE";
$query .= " ORDER BY ".$sort." ".$order.$limit;
// Otherwise, fall back to default view
} else {
$query = "SELECT * FROM ".$table." WHERE 1";
if (!$is_admin)
$query .= " AND hidden IS NOT TRUE";
$query .= " ORDER BY ".$sort." ".$order.$limit;
}
//echo $query;
if ($result = $db->execute_query($query, $params)) {
while ($row = $result->fetch_assoc()) {
$row['queue_url'] = $queue ? 1 : 0;
$results[] = $row;
}
$result->close();
} else {
die("Error in query: $db->error");
}
return $results;
}
/*
* Return array of the POST variables we may care about
* (safer than extract($_POST))
*
* If $stripslashes is non-null, turn every value into a string:
* NULL (or an array) becomes string(""), int(0) becomes string("0").
* (It used to run stripslashes, but magic_quotes_gpc no longer exists.)
*
* If $html is non-null, run the output through htmlspecialchars,
* to translate HTML-unsafe characters. This should only be needed
* if you're outputting back to an HTML form.
*/
function get_post_data($stripslashes = NULL, $html = NULL) {
$queue = get_queue();
$results = array();
$entry['id'] = isset($_POST['id']) ? $_POST['id'] : NULL;
$entry['title'] = isset($_POST['title']) ? $_POST['title'] : NULL;
$entry['author'] = isset($_POST['author']) ? $_POST['author'] : NULL;
$entry['email'] = isset($_POST['email']) ? $_POST['email'] : NULL;
$entry['upload'] = isset($_POST['upload']) ? $_POST['upload'] : NULL;
$entry['story'] = isset($_POST['story']) ? $_POST['story'] : NULL;
$entry['comments'] = isset($_POST['comments']) ? $_POST['comments'] : NULL;
$entry['date'] = isset($_POST['date']) ? $_POST['date'] : NULL;
$entry['hidden'] = isset($_POST['hidden']) ? $_POST['hidden'] : NULL;
$entry['uploaded'] = isset($_POST['uploaded']) ? $_POST['uploaded'] : NULL;
$entry['editor'] = isset($_POST['editor']) ? $_POST['editor'] : NULL;
$entry['remove_img'] = isset($_POST['remove_img']) ? ($_POST['remove_img'] ? 1 : 0) : NULL;
$entry['queue_url'] = $queue ? 1 : 0;
if ($stripslashes) {
$entry = array_map('map_string', $entry);
}
if ($html) {
$entry = array_map('map_html', $entry);
}
$results[] = $entry;
return $results;
}
function map_string($value) {
return is_scalar($value) ? (string)$value : '';
}
function map_html($string) {
return htmlspecialchars(map_string($string), ENT_QUOTES, 'UTF-8', FALSE);
}
function unmap_html($string) {
return htmlspecialchars_decode($string, ENT_QUOTES);
}
/*
* Utility functions to sanitise data
*/
function get_id() {
global $db, $id;
if (is_numeric($id)) {
return $id;
} else if (isset($_REQUEST['id']) && is_numeric($_REQUEST['id'])) {
$id = $db->real_escape_string($_REQUEST['id']);
return $id;
} else {
return NULL;
}
}
function get_search_args() {
global $db;
if (isset($_GET['search']) && is_string($_GET['search'])) {
return $_GET['search'];
}
}
function get_order() {
global $db;
$order = NULL;
if (isset($_GET['order']) && is_string($_GET['order'])) {
$order = $db->real_escape_string($_GET['order']);
}
// Sort ascending by default
if ($order != "ASC" &&
$order != "DESC" &&
$order != "asc" &&
$order != "desc")
if (get_sort_arg() == "date") {
$order = "desc";
}
else $order = "asc";
return $order;
}
function get_sort_arg() {
global $db;
$sort = NULL;
if (isset($_GET['sort']) && is_string($_GET['sort'])) {
$sort = $db->real_escape_string($_GET['sort']);
}
if ($sort != "author" &&
$sort != "date" &&
$sort != "title")
$sort = "date";
return $sort;
}
function get_show_num() {
global $db, $num_stories;
$show = NULL;
if (isset($_GET['show']) && is_string($_GET['show'])) {
$show = $db->real_escape_string($_GET['show']);
}
if (is_numeric($show))
return $show;
else if ($num_stories)
return $num_stories;
else // provide fallback
return 1;
}
function get_start_num() {
global $db;
$start = NULL;
if (isset($_GET['start']) && is_string($_GET['start'])) {
$start = $db->real_escape_string($_GET['start']);
}
if (!is_numeric($start))
$start = 0;
return $start;
}
/*
* Return the queue
*/
function get_queue() {
global $action, $queue;
if ($action == 'save' || $action == 'submit')
$queue = TRUE;
else if (isset($_REQUEST['queue']))
$queue = ($_REQUEST['queue'] === '1') ? TRUE : FALSE;
else if (!is_bool($queue))
$queue = FALSE;
return $queue;
}
/*
* Returns the table name
*/
function which_table($move = FALSE, $action = 'read') {
global $is_admin;
$queue = get_queue();
// Editing: a visitor can never write to the live table
if (!$is_admin && in_array($action, array('post', 'save', 'submit', 'delete'))) {
return 'queue';
} else if ($action == 'delete' && $move && $is_admin) {
return 'queue';
} else if ($action == 'post' && $is_admin) {
return 'xxx';
} else if ($action == 'save' || $action == 'submit') {
return 'queue';
// Viewing
} else if ($queue && $is_admin) {
return 'queue';
} else {
return 'xxx';
}
}