<?php
session_start();
$_username = "****"; //admin username to login
$_password = "******"; //admin password to login
print('<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="https://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>News</title>
<link rel="stylesheet" type="text/css" media="screen" title="Default" href="adminstyle.css" />
</head>
<body>');
if (isset($_POST['submit'])) {
//check if the username and password match
if ($_POST['username'] == $_username && $_POST['password'] == $_password) {
//set session variable
$_SESSION['logged_in'] = "true";
$_SESSION['username'] = $_username;
}
}
//if not logged in show the login form
if (!isset($_SESSION['logged_in'])) {
print('
<div id="login">
<h1>News Login</h1>
<form method="post" action="admin.php" class="login">
<label for="username">Username:</label> <input type="text" id="username" name="username" /><br/>
<label for="password">Password:</label> <input type="password" id="password" name="password" /><br/>
<input type="hidden" name="login" />
<label for="submit"> </label> <input type="submit" id="submit" name="submit" value="Login" /><br/>
<p style="font-size: 9px; text-align: center;">Created by <a href="https://d-webz.org">DylanM</a>.</p>
</div>
</form>');
//if logout is requested
} elseif (isset($_GET['do']) && $_GET['do'] == "logout") {
session_start();
$_SESSION = array();
session_destroy();
echo '<META HTTP-EQUIV="refresh" content="1"; URL="admin.php">';
} else {
print('<script type="text/javascript">
function preview(id1, id2){
var NewText = document.getElementById(id1).value;
splitText = NewText.split(/n/).join("");
var DivElement = document.getElementById(id2);
DivElement.innerHTML = splitText;
}
</script>
');
include '../config.php';
print('<div id="container"> <h1>Admin Panel</h1>
<p style="text-align: center;"><a href="?">Admin Home</a> | <a href="?action=new">New Entry</a> | <a href="?action=entries">Edit Entries</a> | <a href="?do=logout">Logout</a></p>');
if ($action == "") {
print("<p>Woot. This is your admin panel page. Use the above page to add, edit, and delete news. Created by DylanM (3xS). www.d-webz.org</p>");
}elseif ($action == "entries") {
//get pages from the database
$query = "SELECT * FROM entries ORDER BY id DESC";
$sql = mysql_query($query);
print('<form method="post" action="" class="table">
<table width="760">
<tr>
<th>Select</td>
<th>Category</td>
<th>Title</td>
<th>Date</td>
</tr>
');
while($row = mysql_fetch_array($sql)){
$id = $row['id'];
$category = stripslashes($row['category']);
$title = stripslashes($row['title']);
$date = $row['date'];
// show entries
print('<tr>
<td><input type="checkbox" name="selected[]" value="$id"></td>
<td>$category</td>
<td><a href="?action=edit&id=$id">$title</a></td>
<td>$date</td>
<td><a href="?action=showcomments&id=$id">$comnum</a></td>
</tr>
');
}
print('
</table>
<br/>
<label for="action">Action:</label>
<select name="action" id="action">
<option value="archive">Archive
<option value="delete">Delete
</select>
<input type="submit" id="submit" name="Submit">
</form>
');
}elseif($action == "new"){
print('<div class="input">
<form method="post" id="addentry" action="?action=addnewentry">
<label for="title">Title</label><input id="title" name="title" tabindex="1" type="text"><br/>
<label for="category">Category</label><input id="category" name="category" tabindex="2" type="text" value="home"><br/>
<label for="addshort">Short</label><textarea name="addshort" wrap="virtual" id="addshort" tabindex="3"></textarea><br/><br/>
<label for="addfull">Full</label><textarea name="addfull" wrap="virtual" id="addfull" tabindex="4"></textarea><br/>
<label for="submit">Submit</label><input id="submit" name="submit" value="Submit" tabindex="5" type="submit">
</div>
<div class="story">
<h1>Short Preview:</h1>
<div id="addpreview-short"></div><br/>
<h1>Full Preview:</h1>
<div id="addpreview-full"></div>
</div>
');
}elseif($action == "addnewentry"){
$title = mysql_real_escape_string($_POST['title']);
$category = mysql_real_escape_string($_POST['category']);
$short = mysql_real_escape_string($_POST['addshort']);
$full = mysql_real_escape_string($_POST['addfull']);
$query = "INSERT INTO entries (id, category, title, date, short, full)
VALUES (NULL, '$category', '$title', NOW(), '$short', '$full');";
mysql_query($query) or die("Add failed: " . mysql_error());
echo mysql_affected_rows() . ' record added.';
echo '<br/><a href="admin.php">Go back.</a>';
}elseif ($action == "delete"){
$selected = implode(",", $_POST['selected']);
$query = "DELETE FROM entries WHERE id IN ($selected)";
mysql_query($query) or die("Delete failed: " . mysql_error());
echo mysql_affected_rows() . ' record(s) deleted.';
echo '<br/><a href="admin.php">Go back.</a>';
}elseif($action == "archive"){
$selected = implode(",", $_POST['selected']);
$query = "UPDATE entries SET category='archive' WHERE id IN ($selected)";
mysql_query($query) or die("Archive failed: " . mysql_error());
echo mysql_affected_rows() . ' record(s) moved to the archives.';
echo '<br/><a href="admin.php">Go back.</a>';
}elseif($action == "edit"){
$id = mysql_real_escape_string($_GET['id']);
//get page from the database
$query = "SELECT * FROM entries WHERE id = '$id'";
$sql = mysql_query($query);
$row = mysql_fetch_array($sql);
$title = stripslashes($row['title']);
$category = stripslashes($row['category']);
$date = stripslashes($row['date']);
$short = stripslashes($row['short']);
$full = stripslashes($row['full']);
print('<div class="input">
<form method="post" id="editentry" action="?action=editentry&id=$id">
<label for="title">Title</label><input id="title" name="title" tabindex="1" value="$title" type="text"><br/>
<label for="category">Category</label><input id="category" name="category" value="$category" tabindex="2" type="text"><br/>
<label for="editshort">Short</label><textarea name="editshort" wrap="virtual" id="editshort" tabindex="3">$short</textarea><br/><br/>
<label for="editfull">Full</label><textarea name="editfull" wrap="virtual" id="editfull" tabindex="4">$full</textarea><br/>
<label for="submit">Submit</label><input id="submit" name="submit" value="Submit" tabindex="5" type="submit">
</div>
<div class="story">
<h1>Short Preview:</h1>
<div id="editpreview-short"></div><br/>
<h1>Full Preview:</h1>
<div id="editpreview-full"></div>
</div>
');
}elseif($action == "editentry"){
$id = mysql_real_escape_string($_GET['id']);
$title = mysql_real_escape_string($_POST['title']);
$title = htmlspecialchars("$title");
$category = "{$_POST['category']}";
$short = mysql_real_escape_string($_POST['editshort']);
$short = htmlspecialchars("$short");
$full = mysql_real_escape_string($_POST['editfull']);
$full = htmlspecialchars("$full");
$query = "UPDATE entries SET title = '$title', category = '$category', short = '$short', full = '$full' WHERE id = $id;";
mysql_query($query) or die("Edit failed: " . mysql_error());
echo mysql_affected_rows() . ' record modified.';
echo '<br/><a href="admin.php">Go back.</a>';
}else{
echo "There was an error";
echo '<br/><a href="admin.php">Go back.</a>';
}
print('<p style="font-size: 9px; text-align: center;">Created by <a href="https://d-webz.org">DylanM</a>.</p></div>');
}
?>
</body>
</html>
