Private Message System

CREATE TABLE `privates` (
`pid` INT( 11 ) NOT NULL auto_increment,
`to` VARCHAR( 255 ) NOT NULL,
`from` VARCHAR( 255 ) NOT NULL,
`date` VARCHAR( 255 ) NOT NULL,
`status` CHAR( 6 ) NOT NULL default 'Unread',
`subject` VARCHAR( 255 ) NOT NULL default 'Untitled Message',
`content` TEXT NOT NULL,
PRIMARY KEY(`pid`)
);

<?php
session_start(); //Start session
include("config.php"); //Include config file
if(!$logged[id]){ //Check if user is logged in
echo "<b>Error</b>: You Are Not Logged In!"; //Not logged in
}else{ //Their loggedin
switch($_GET[page]){ //make some links ?page=case
default: //set up the default page upon going to pms.php
$msgs = mysql_query("SELECT * FROM `privates` WHERE `to` = '" . $logged[username] . "' ORDER BY `pid` ASC") or die(mysql_error()); //get all the messages to the loged in user
echo "<a href=\"pms.php?page=compose\">Compose Message</a>
<a href=\"pms.php?page=delall\">Delete All Messages</a>
 
<table width=\"350\" cellpadding=\"0\" cellspacing=\"3\">
<tr>
<td align=\"center\" valign=\"middle\" width=\"100\">
<b>Subject</b>
</td>
<td align=\"center\" valign=\"middle\" width=\"50\">
<b>From</b>
</td>
<td align=\"center\" valign=\"middle\" width=\"50\">
<b>Date Sent</b>
</td>
<td align=\"center\" valign=\"middle\" width=\"50\">
<b>Status</b>
</td>
<td align=\"center\" valign=\"middle\" width=\"100\">
<b>Delete Message</b>
</td>
</tr>"; //echo the start5 table and create msg link/delete all links!
if(mysql_num_rows($msgs) == 0){ //check if there are messages or not
echo "<tr><td width=\"300\" colspan=\"3\" align=\"center\" valign=\"middle\">You Have No New Messages!</td></tr>"; //no new messages
}else{ //or if there are messages
while($r = mysql_fetch_array($msgs)){ //repeat for all the messages
echo "<tr><td align=\"center\" valign=\"middle\" width=\"100\">
<a href=\"pms.php?page=view&id=$r[pid]\">$r[subject]</a></td>
<td align=\"center\" valign=\"middle\" width=\"50\">
<a href=\"members.php?user=$r[from]\">$r[from]</a>
</td>
<td align=\"center\" valign=\"middle\" width=\"50\">
$r[date]
</td>
<td align=\"center\" valign=\"middle\" width=\"50\">
$r[status]
</td>
<td align=\"center\" valign=\"middle\" width=\"100\">
<a href=\"pms.php?page=delete&id=$r[pid]\">Delete</a>
</td>
</tr>"; //echo the messages
} //end while
} //end message amount check
echo "</table>"; //end table
break; //end the default page
case 'view': //define the view page
$id = (int)htmlspecialchars(strip_tags($_GET[id])); //make the ID safe
if(!$id){ //if there is no ID to select
echo "<a href=\"pms.php\">Go Back</a>No ID Selected!"; //echo the error
}else{ //or if there is....
$select = mysql_query("SELECT * FROM `privates` WHERE `pid` = '" . $id . "';"); //get the message's info
$msg = mysql_fetch_array($select); //select all data
if($msg[to] != $logged[username]){ //check if the user logged in is the owner of the message
echo "<a href=\"pms.php\">Go Back</a>This Message Was Not Sent To You"; //if not
}else{ //maybe...
if(!$_POST[reply]) { //if the reply was not submitted
$mark = mysql_query("UPDATE `privates` SET `status` = 'Read' WHERE `pid` = '" . $id . "'") or die(mysql_error()); //mark it as Read
$message = nl2br(stripslashes($msg[content])); //make new lines to  and strip the slashes
$subject = stripslashes($msg[subject]); //strip the slashes
echo "<a href=\"pms.php\">Go Back</a>
<form method=\"post\">
<dl style=\"margin: 0px;\">
<dt><b>Subject</b>: $subject</dt>
<dt><b>From</b>: $msg[from]</dt>
<dt>$message</dt>
<dt><textarea rows=\"6\" cols=\"45\" name=\"msg\"></textarea>
<input type=\"submit\" name=\"reply\" value=\"Reply\"></dt>
</dl>
</form>"; //echo the message and reply box.
}else{ //if the form was submitted
$to = $msg[from]; //get who it is to
$from = $logged[username]; //who its from
$subject = "RE: " . $msg[subject]; //new subject
$msg = addslashes($_POST[msg]); //the content
$date = date("F j, Y, g:i a"); //the date sent
$do = mysql_query("INSERT INTO `privates` (`to`,`from`,`date`,`subject`,`content`) VALUES ('" . $to . "','" . $from . "','" . $date . "','" . $subject . "','" . $msg . "')") or die(mysql_error()); //insert into the table!
echo "Message Sent!"; //the message was sent
} //end reply check
} //end check posession
} //end id check
break;
case 'compose': //create a new message
if(!$_POST[send]){ //if the form was not submitted
echo "<a href=\"pms.php\">Go Back</a>
<form method=\"post\" action=\"\">
<b>To User</b>:<Br />"; //echo some of the form and whatnot
if(isset($_GET[user])){ //check if there is a user in the address bar
echo "<input type=\"text\" name=\"to\" value=\"$_GET[user]\" size=\"15\">"; //if there is
}else{ //or not..
echo "<input type=\"text\" name=\"to\" size=\"15\">"; //echo the input box without the value of the user!
} //end user check in address bar
echo "<b>Subject</b>:
<input type=\"text\" name=\"title\" value=\"Unitiled Message\" size=\"15\">
<b>Content</b>:
<textarea name=\"message\" rows=\"6\" cols=\"45\"></textarea>
<input type=\"submit\" name=\"send\" value=\"Send Message\">
</form>"; //echo the rest of the form
}else{ //or if it was....
$to = stripslashes(htmlspecialchars(strip_tags($_POST[to]))); //who its to
$from = $logged[username]; //who its from
$date = date("F j, Y, g:i a"); //the date sent
$msg = addslashes($_POST[message]); //the message variable
$subject = addslashes($_POST[title]); //the subject
$do = mysql_query("INSERT INTO `privates` (`to`,`from`,`date`,`subject`,`content`) VALUES ('" . $to . "','" . $from . "','" . $date . "','" . $subject . "','" . $msg . "')") or die(mysql_error()); //insert into the table!
echo "Message Sent!";
} //end sent check
break; //end make new msg
case 'delall': //delete all page
$get = mysql_query("SELECT * FROM `privates` WHERE `to` = '" . $logged[username] . "'"); //get the private messages
 
if(mysql_num_rows($get) == "0"){
    echo "You Have No Messages To Delete!";
}else{
$delete = mysql_query("DELETE FROM `privates` WHERE `to` = '" . $logged[username] . "'"); //delete tehm
    if($delete) { //check if theres a mySQL error
        echo "Messages Deleted"; //success
    }else{ //or not
        echo "mySQL Error Encountered!";
    } //end error check
} //end msg check
break; //end page
case 'delete': //start the delete page!
$id = (int)htmlspecialchars(strip_tags($_GET[id])); //make the ID safe
if(!$id){ //if there is no ID to select
echo "<a href=\"pms.php\">Go Back</a>No ID Selected!"; //echo the error
}else{ //or if there is....
$select = mysql_query("SELECT * FROM `privates` WHERE `pid` = '" . $id . "'"); //get the message's info
$msg = mysql_fetch_array($select); //select all data
if($msg[to] != $logged[username]){ //check if the user logged in is the owner of the message
echo "<a href=\"pms.php\">Go Back</a>This Message Was Not Sent To You"; //if not
}else{ //maybe...
$do = mysql_query("DELETE FROM `privates` WHERE `pid` = '" . $id . "'") or die(mysql_error());
echo "<a href=\"pms.php\">Go Back</a><Br />Messages Deleted!";
} //end check possession
} //end id check
break; //end the delete page!
} //end switch/get
} //end login check
?>

Location: $user[location]<br>
Sex: $user[sex]<br>
Age: $user[age]

Location: $user[location]<br>
Sex: $user[sex]<br>
Age: $user[age]<br>
<a href='pms.php?page=compose&user=$user[username]'>Send Message</a>