PHP Code
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
<?php
session_start(); //Start session
include("config.php"); //Include config file
if(!$logged[id]){ //Check if user is logged in
echo "<b>Error</b>: You Are Not Logged In!"; //Not logged in
}else{ //Their loggedin
switch($_GET[act]){ //make some links ?page=case
default: //set up the default page upon going to pms.php
$msgs = mysql_query("SELECT * FROM `privates` WHERE `to` = '" . $logged[username] . "' ORDER BY `pid` ASC") or die(mysql_error()); //get all the messages to the loged in user
echo "<a href=\"?page=pms&act=compose\">Compose Message</a>
<a href=\"?page=pms&act=delall\">Delete All Messages</a>
<table width=\"350\" cellpadding=\"0\" cellspacing=\"3\">
<tr>
<td align=\"center\" valign=\"middle\" width=\"100\">
<b>Subject</b>
</td>
<td align=\"center\" valign=\"middle\" width=\"50\">
<b>From</b>
</td>
<td align=\"center\" valign=\"middle\" width=\"50\">
<b>Date Sent</b>
</td>
<td align=\"center\" valign=\"middle\" width=\"50\">
<b>Status</b>
</td>
<td align=\"center\" valign=\"middle\" width=\"100\">
<b>Delete Message</b>
</td>
</tr>"; //echo the start5 table and create msg link/delete all links!
if(mysql_num_rows($msgs) == 0){ //check if there are messages or not
echo "<tr><td width=\"300\" colspan=\"3\" align=\"center\" valign=\"middle\">You Have No New Messages!</td></tr>"; //no new messages
}else{ //or if there are messages
while($r = mysql_fetch_array($msgs)){ //repeat for all the messages
echo "<tr><td align=\"center\" valign=\"middle\" width=\"100\">
<a href=\"pms.php?page=view&id=$r[pid]\">$r[subject]</a></td>
<td align=\"center\" valign=\"middle\" width=\"50\">
<a href=\"members.php?user=$r[from]\">$r[from]</a>
</td>
<td align=\"center\" valign=\"middle\" width=\"50\">
$r[date]
</td>
<td align=\"center\" valign=\"middle\" width=\"50\">
$r[status]
</td>
<td align=\"center\" valign=\"middle\" width=\"100\">
<a href=\"pms.php?page=delete&id=$r[pid]\">Delete</a>
</td>
</tr>"; //echo the messages
} //end while
} //end message amount check
echo "</table>"; //end table
break; //end the default page
case 'view': //define the view page
$id = (int)htmlspecialchars(strip_tags($_GET[id])); //make the ID safe
if(!$id){ //if there is no ID to select
echo "<a href=\"pms.php\">Go Back</a>No ID Selected!"; //echo the error
}else{ //or if there is....
$select = mysql_query("SELECT * FROM `privates` WHERE `pid` = '" . $id . "';"); //get the message's info
$msg = mysql_fetch_array($select); //select all data
if($msg[to] != $logged[username]){ //check if the user logged in is the owner of the message
echo "<a href=\"pms.php\">Go Back</a>This Message Was Not Sent To You"; //if not
}else{ //maybe...
if(!$_POST[reply]) { //if the reply was not submitted
$mark = mysql_query("UPDATE `privates` SET `status` = 'Read' WHERE `pid` = '" . $id . "'") or die(mysql_error()); //mark it as Read
$message = nl2br(stripslashes($msg[content])); //make new lines to and strip the slashes
$subject = stripslashes($msg[subject]); //strip the slashes
echo "<a href=\"pms.php\">Go Back</a>
<form method=\"post\">
<dl style=\"margin: 0px;\">
<dt><b>Subject</b>: $subject</dt>
<dt><b>From</b>: $msg[from]</dt>
<dt>$message</dt>
<dt><textarea rows=\"6\" cols=\"45\" name=\"msg\"></textarea>
<input type=\"submit\" name=\"reply\" value=\"Reply\"></dt>
</dl>
</form>"; //echo the message and reply box.
}else{ //if the form was submitted
$to = $msg[from]; //get who it is to
$from = $logged[username]; //who its from
$subject = "RE: " . $msg[subject]; //new subject
$msg = addslashes($_POST[msg]); //the content
$date = date("F j, Y, g:i a"); //the date sent
$do = mysql_query("INSERT INTO `privates` (`to`,`from`,`date`,`subject`,`content`) VALUES ('" . $to . "','" . $from . "','" . $date . "','" . $subject . "','" . $msg . "')") or die(mysql_error()); //insert into the table!
echo "Message Sent!"; //the message was sent
} //end reply check
} //end check posession
} //end id check
break;
case 'compose': //create a new message
if(!$_POST[send]){ //if the form was not submitted
echo "<a href=\"?page=pms\">Go Back</a>
<form method=\"post\" action=\"\">
<b>To User</b>:<Br />"; //echo some of the form and whatnot
if(isset($_GET[user])){ //check if there is a user in the address bar
echo "<input type=\"text\" name=\"to\" value=\"$_GET[user]\" size=\"15\">"; //if there is
}else{ //or not..
echo "<input type=\"text\" name=\"to\" size=\"15\">"; //echo the input box without the value of the user!
} //end user check in address bar
echo "<b>Subject</b>:
<input type=\"text\" name=\"title\" value=\"Unitiled Message\" size=\"15\">
<b>Content</b>:
<textarea name=\"message\" rows=\"6\" cols=\"45\"></textarea>
<input type=\"submit\" name=\"send\" value=\"Send Message\">
</form>"; //echo the rest of the form
}else{ //or if it was....
$to = stripslashes(htmlspecialchars(strip_tags($_POST[to]))); //who its to
$from = $logged[username]; //who its from
$date = date("F j, Y, g:i a"); //the date sent
$msg = addslashes($_POST[message]); //the message variable
$subject = addslashes($_POST[title]); //the subject
$do = mysql_query("INSERT INTO `privates` (`to`,`from`,`date`,`subject`,`content`) VALUES ('" . $to . "','" . $from . "','" . $date . "','" . $subject . "','" . $msg . "')") or die(mysql_error()); //insert into the table!
echo "Message Sent!";
} //end sent check
break; //end make new msg
case 'delall': //delete all page
$get = mysql_query("SELECT * FROM `privates` WHERE `to` = '" . $logged[username] . "'"); //get the private messages
if(mysql_num_rows($get) == "0"){
echo "You Have No Messages To Delete!";
}else{
$delete = mysql_query("DELETE FROM `privates` WHERE `to` = '" . $logged[username] . "'"); //delete tehm
if($delete) { //check if theres a mySQL error
echo "Messages Deleted"; //success
}else{ //or not
echo "mySQL Error Encountered!";
} //end error check
} //end msg check
break; //end page
case 'delete': //start the delete page!
$id = (int)htmlspecialchars(strip_tags($_GET[id])); //make the ID safe
if(!$id){ //if there is no ID to select
echo "<a href=\"?page=pms\">Go Back</a>No ID Selected!"; //echo the error
}else{ //or if there is....
$select = mysql_query("SELECT * FROM `privates` WHERE `pid` = '" . $id . "'"); //get the message's info
$msg = mysql_fetch_array($select); //select all data
if($msg[to] != $logged[username]){ //check if the user logged in is the owner of the message
echo "<a href=\"?page=pms\">Go Back</a>This Message Was Not Sent To You"; //if not
}else{ //maybe...
$do = mysql_query("DELETE FROM `privates` WHERE `pid` = '" . $id . "'") or die(mysql_error());
echo "<a href=\"?page=pms\">Go Back</a><Br />Messages Deleted!";
} //end check possession
} //end id check
break; //end the delete page!
} //end switch/get
} //end login check
?>
