Advanced shop.

CREATE TABLE `shop_items` (
`id` int(11) NOT NULL auto_increment,
`name` varchar(225) NOT NULL,
`price` varchar(225) NOT NULL,
`image` varchar(225) NOT NULL,
PRIMARY KEY (`id`)
) ENGINE=MyISAM;
 
-- --------------------------------------------------------
 
CREATE TABLE `user_shop_items` (
`id` int(11) NOT NULL auto_increment,
`name` varchar(225) NOT NULL,
`image` varchar(225) NOT NULL,
`owner` varchar(225) NOT NULL,
PRIMARY KEY (`id`)
) ENGINE=MyISAM;

<?php
session_start();
include "config.php";
if($logged[username])
{
switch($_GET[page])
{
default:
echo ("Welcome to the shop.<br>");
$fetch = mysql_query("SELECT * FROM `shop_items`");
$rows = mysql_num_rows($fetch);
if ($rows == 0)
{
echo ("No shop items. Sorry.");
}
else
{
while ($shop = mysql_fetch_array($fetch))
{
echo ("<img src='$shop[image]'> | $shop[name] | $shop[price] - <a href='?page=verify&id=$shop[id]'>Purchase</a><br>");
}
}
break;
 
case 'verify':
$id = strip_tags(htmlspecialchars($_GET[id]));
$fetch = mysql_query("SELECT * FROM `shop_items` WHERE `id` = '$id'");
$shop = mysql_fetch_array($fetch);
echo ("Are you sure you want to purchase $shop[name]?<br> <a href='?page=purchase&id=$id'>Yes</a> - <a href='shop.php'>No</a>");
break;
 
case 'purchase':
$id = strip_tags(htmlspecialchars($_GET[id]));
$fetch = mysql_query("SELECT * FROM `shop_items` WHERE `id` = '$id'");
$shop = mysql_fetch_array($fetch);
 
if ($logged[points] < $shop[price])
{
echo ("You don't have enough points. <a href='shop.php'>Back</a>");
}
else
{
$fetch = mysql_query("SELECT * FROM `members` WHERE `username` = '$username'");
$user = mysql_fetch_array($fetch);
 
$points1 = $logged[points]-$shop[price];
 
$update1 = mysql_query("UPDATE `members` SET `points` = '$points1' WHERE `username` = '$logged[username]'");
$update2 = mysql_query("INSERT INTO `user_shop_items` (`owner`, `image`, `name`) VALUES ('$logged[username]', '$shop[image]', '$shop[name]')");
echo ("Thank you for purchasing $shop[name]. Please come again. <a href='shop.php'>Back</a>");
}
break;
}
}
?>

$update2 = mysql_query("INSERT INTO `user_shop_items` (`owner`, `image`, `name`) VALUES ('$logged[username]', '$shop[image]', '$shop[name]')");

<?php
session_start();
include "config.php";
if($logged[username] && $logged[userlevel] == 6)
{
switch($_GET[page])
{
default:
echo ("Welcome to the shop admin. <a href='?page=add'>Add a shop item</a><br><br>");
$fetch = mysql_query("SELECT * FROM `shop_items`");
$rows = mysql_num_rows($fetch);
if ($rows == 0)
{
echo ("No shop items. Sorry. <a href='?page=add'>Add a shop item</a>");
}
else
{
while ($shop = mysql_fetch_array($fetch))
{
echo ("<img src='$shop[image]'> | $shop[name] | $shop[price] - <a href='?page=edit&id=$shop[id]'>Edit</a> // <a href='?page=verifydelete&id=$shop[id]'>Delete</a><br>");
}
}
break;
 
case 'add':
echo ("<form method='post' action='?page=additem'>
Name: <input type='text' name='name'><br>
Price: <input type='text' name='price'><br>
Image: <input type='text' name='image'><br>
<input type='submit' value='Add' name='submit'>
</form>
");
break;
 
case 'additem':
$image = strip_tags(htmlspecialchars($_POST[image]));
$name = strip_tags(htmlspecialchars($_POST[name]));
$price = strip_tags(htmlspecialchars($_POST[price]));
$add = mysql_query("INSERT INTO `shop_items` (`price`, `image`, `name`) VALUES ('$price', '$image', '$name')");
echo ("$name has been added to the shop. thank you. <a href='shop_admin.php'>Back</a>");
break;
 
case 'edit':
$id = strip_tags(htmlspecialchars($_GET[id]));
$fetch = mysql_query("SELECT * FROM `shop_items` WHERE `id` = '$id'");
$shop = mysql_fetch_array($fetch);
echo ("<form method='post' action='?page=edititem&id=$id'>
Name: <input type='text' value='$shop[name]' name='name'><br>
Price: <input type='text' value='$shop[price]' name='price'><br>
Image: <input type='text' value='$shop[image]' name='image'><br>
<input type='submit' value='Edit' name='submit'>
</form>
");
break;
 
case 'edititem':
$id = strip_tags(htmlspecialchars($_GET[id]));
$image = strip_tags(htmlspecialchars($_POST[image]));
$name = strip_tags(htmlspecialchars($_POST[name]));
$price = strip_tags(htmlspecialchars($_POST[price]));
$edit = mysql_query("UPDATE `shop_items` SET `image` = '$image', `name` = '$name', `price` = '$price' WHERE `id` = '$id'");
echo ("$shop[name] has been edited thank you. <a href='shop_admin.php'>Back</a>");
break;
 
case 'verifydelete':
$id = strip_tags(htmlspecialchars($_GET[id]));
$fetch = mysql_query("SELECT * FROM `shop_items` WHERE `id` = '$id'");
$shop = mysql_fetch_array($fetch);
echo ("Are you sure you want to delete $shop[name]?<br> <a href='?page=delete&id=$id'>Yes</a> - <a href='shop.php'>No</a>");
break;
 
case 'delete':
$id = strip_tags(htmlspecialchars($_GET[id]));
$delete = mysql_query("DELETE FROM `shop_items` WHERE `id` = '$id'");
echo ("$shop[name] has been deleted thank you. <a href='shop_admin.php'>Back</a>");
break;
}
}
?>

$fetch = mysql_query("INSERT INTO `shop_items` (`price`, `image`, `name`) VALUES ('$price', '$image', '$name')");

$edit = mysql_query("UPDATE `shop_items` SET `image` = '$image', `name` = '$name', `price` = '$price' WHERE `id` = '$id'");

$delete = mysql_query("DELETE FROM `shop_items` WHERE `id` = '$id'");