cvs: php-hosts-web /msgboard message.php post.php preview.php shared-msgboard.inc
| From: | jim winstead | Date: | Mon, 22 Apr 2002 00:42:04 +0000 |
| Subject: | cvs: php-hosts-web /msgboard message.php post.php preview.php shared-msgboard.inc | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-9740@lists.php.net to get a copy of this message | ||
jimw Sun Apr 21 20:42:04 2002 EDT
Modified files:
/php-hosts-web/msgboard message.php post.php preview.php
shared-msgboard.inc
Log:
avoid using file when writing a new message
Index: php-hosts-web/msgboard/message.php diff -u php-hosts-web/msgboard/message.php:1.2 php-hosts-web/msgboard/message.php:1.3 --- php-hosts-web/msgboard/message.php:1.2 Sun Apr 21 20:02:20 2002 +++ php-hosts-web/msgboard/message.php Sun Apr 21 20:42:03 2002 @@ -12,7 +12,7 @@ commonHeader("Message: $section"); title("Message: $section"); -showMessage("show",$subj,$subgroup,$name,$email,$date,$document,$parent,$id); +showMessage("show",$subj,$subgroup,$name,$email,$date,$parent,$id); $q2=mysql($DBASE, "select id from $TABLE_MSGS where parent=$id and subgroup=$subgroup"); if (mysql_numrows($q2)!=0): echo "<TR VALIGN=top><TD align=left colspan=2><FONT FACE=\"$FONTFACE\" SIZE=-1>Follow-ups:<p>\n"; Index: php-hosts-web/msgboard/post.php diff -u php-hosts-web/msgboard/post.php:1.2 php-hosts-web/msgboard/post.php:1.3 --- php-hosts-web/msgboard/post.php:1.2 Sun Apr 21 20:13:59 2002 +++ php-hosts-web/msgboard/post.php Sun Apr 21 20:42:03 2002 @@ -15,21 +15,17 @@ else: title("Post a New Message: ".$groupname); endif; - $time=time(); - $subj=addslashes($subj); - $email=addslashes($email); - $name=addslashes($name); - $query="insert into $TABLE_MSGS values (0,$time,$subgroup,$parent,$type,'$subj','$email','$name',$fileid)"; - echo "<!-- $query -->\n"; - mysql_db_query($DBASE,$query); - $id=mysql_insert_id(); - $newfile="$MSGS/$id"; - if (file_exists($tempfile)): - $command=QuoteMeta("mv $tempfile $newfile"); - exec($command); - endif; + if (!get_magic_quotes_gpc()) { + $subj=addslashes($subj); + $email=addslashes($email); + $name=addslashes($name); + $message = addslashes($message); + } + $query = "INSERT INTO $TABLE_MSGS SET date=NOW(),subgroup=$subgroup,parent=$parent,type=$type,subj='$subj',email='$email',name='$name',message='$message')"; + mysql_query($query); + $id = mysql_insert_id(); echo "<FONT SIZE=+1><b>Message posted.</b></FONT><P>\n"; echo "<CENTER>\n"; @@ -57,9 +53,9 @@ document.forms[0].elements['subj'].focus(); return false ; } - if (document.forms[0].elements['txt'].value == "") { + if (document.forms[0].elements['message'].value == "") { alert("You need to enter something for your message."); - document.forms[0].elements['txt'].focus(); + document.forms[0].elements['message'].focus(); return false ; } return true; @@ -75,16 +71,14 @@ <INPUT TYPE="hidden" NAME="type" value="<? echo $HTML;?>"> <INPUT TYPE="hidden" NAME="subgroup" value=<? echo $subgroup;?> > <input TYPE="hidden" NAME="MAX_FILE_SIZE" VALUE="<? echo $MAX_DOC_SIZE;?>"> -<? +<?php $subj=""; -if(isSet($parent)): +if($parent = (int)$parent) { echo "<input type=\"hidden\" name=\"parent\" value=\"$parent\">"; - $q1=mysql($DBASE,"select subj from $TABLE_MSGS where id=$parent"); - $subj=mysql_result($q1,0,"subj"); - if (!ereg("^Re:",$subj)): + $subj = mysql_get_one("SELECT subj FROM $TABLE_MSGS WHERE id=$parent"); + if (!ereg("^Re:",$subj)) $subj="Re: ".$subj; - endif; -endif; +} ?> <TABLE BORDER=0 cellpadding=5 cellspacing=0 WIDTH=<? echo $TABLE_WIDTH;?> BGCOLOR="<? echo $MSG_FRAME_COLOR;?>"> <TR VALIGN=top BGCOLOR="<? echo $MSG_FRAME_COLOR2;?>"> @@ -106,7 +100,7 @@ </TR> <TR VALIGN=top> <TD ALIGN=right><FONT FACE="<? echo $FONTFACE;?>" SIZE=-1>Message:</TD> -<TD><textarea rows=8 cols=40 name="txt" WRAP="virtual"></textarea><? reqStar();?></TD> +<TD><textarea rows=8 cols=40 name="message" WRAP="virtual"></textarea><? reqStar();?></TD> </TR> <TR VALIGN=top> <TD><BR></TD> Index: php-hosts-web/msgboard/preview.php diff -u php-hosts-web/msgboard/preview.php:1.2 php-hosts-web/msgboard/preview.php:1.3 --- php-hosts-web/msgboard/preview.php:1.2 Sun Apr 21 20:13:59 2002 +++ php-hosts-web/msgboard/preview.php Sun Apr 21 20:42:03 2002 @@ -7,7 +7,7 @@ echo "<FORM><input type=submit value=\" « Go Back \" onClick=\"history.go(-1);\"></FORM>\n"; exit; endif; -if($txt==""): +if($message==""): echo "<B>You need to say <I>something</I>!</B><BR>\n"; echo "<FORM><input type=submit value=\" « Go Back \" onClick=\"history.go(-1);\"></FORM>\n"; exit; @@ -17,18 +17,16 @@ if(!$subj): $subj="(no title)"; endif; -if(!isSet($parent)): - $parent=0; -endif; - -$tempfile = tempnam( "/tmp", "phphosts_" ); -if ($txt!=""): - $fp=fopen($tempfile,"w"); - fputs($fp,$txt); - fclose($fp); -endif; +$parent = (int)$parent; $date=date($DATE_FORMAT); + +if (get_magic_quotes_gpc()) { + $name = stripslashes($name); + $email = stripslashes($email); + $subj = stripslashes($subj); + $message = stripslashes($message); +} ?> <form method=post action="post.php"> <input type=hidden name="mode" value="post"> @@ -37,11 +35,10 @@ <input type=hidden name="name" value="<? qecho($name);?>"> <input type=hidden name="email" value="<? qecho($email);?>"> <input type=hidden name="subj" value="<? qecho($subj);?>"> -<input type=hidden name="tempfile" value="<? echo $tempfile;?>"> +<input type=hidden name="message" value="<? qecho($message);?>"> <input type=hidden name="subgroup" value=<? echo $subgroup;?>> -<input type=hidden name="fileid" value=<? echo $fileid;?>> <? -showMessage("preview",$subj,$subgroup,$name,$email,$date,$fileid,$parent,$txt); +showMessage("preview",$subj,$subgroup,$name,$email,$date,$parent,$message); ?> <TR VALIGN=top BGCOLOR="<? echo $MSG_FRAME_COLOR2;?>"> <TD align=left><input type=button value=" « Go Back " onClick="history.go(-1);"></TD> Index: php-hosts-web/msgboard/shared-msgboard.inc diff -u php-hosts-web/msgboard/shared-msgboard.inc:1.5 php-hosts-web/msgboard/shared-msgboard.inc:1.6 --- php-hosts-web/msgboard/shared-msgboard.inc:1.5 Sun Apr 21 20:17:03 2002 +++ php-hosts-web/msgboard/shared-msgboard.inc Sun Apr 21 20:42:03 2002 @@ -171,7 +171,6 @@ $id=mysql_result($q1,$i,"id"); $date=mysql_result($q1,$i,"date"); $subj=mysql_result($q1,$i,"subj"); - $document=mysql_result($q1,$i,"document"); echo "<TR VALIGN=middle BGCOLOR=\"".$BGCOLOR[$jjj%2]."\">\n"; $jjj++; @@ -217,7 +216,7 @@ -function showMessage ($mode, $subj, $subgroup, $name, $email, $date, $document, $parent, $post) { +function showMessage ($mode, $subj, $subgroup, $name, $email, $date, $parent, $post) { /* * Displays a message (!) */ @@ -239,8 +238,7 @@ echo "<TR VALIGN=top><TD align=right>$FT1 Date:</TD><TD align=left>$FT2<B>$date</B></TD></TR>\n"; if($parent>0): echo "<TR VALIGN=top><TD align=right>$FT1 Follow-Up To:</TD><TD align=left>$FT2"; - $q3=mysql($DBASE, "select subj from $TABLE_MSGS where id=$parent"); - $psubj=mysql_result($q3,0,"subj"); + $psubj = mysql_get_one("SELECT subj FROM $TABLE_MSGS WHERE id=$parent"); if ($mode=="preview"): echo "<B>$psubj</B></TD></TR>\n"; else: @@ -251,10 +249,10 @@ endif; echo "<TR VALIGN=top BGCOLOR=\"$MSG_TEXT_COLOR\"><TD colspan=2>$FT2\n"; if ($mode=="preview"): - echo nl2br($post); + echo nl2br(htmlentities($post)); else: $show = mysql_get_one("SELECT message FROM $TABLE_MSGS WHERE id=$post"); - echo nl2br($show); + echo nl2br(htmlentities($show)); endif; echo "</TD></TR>\n"; }; @@ -272,17 +270,16 @@ /* * Deletes a posted message, and any attachments */ - global $MSGS, $DOCS, $DBASE, $TABLE_MSGS, $TABLE_DOCS; - $q1=@mysql_db_query($DBASE, "select * from $TABLE_MSGS where id=$id"); + global $MSGS, $TABLE_MSGS; + $q1=@mysql_query("select * from $TABLE_MSGS where id=$id"); if(mysql_numrows($q1)!=1 || $q1==-1): echo "<FONT COLOR=\"#800000\">Error: ".mysql_error()."<BR>Message $id not deleted.</FONT><BR>\n"; return(-1); else: $subj=mysql_result($q1,0,"subj"); $parent=mysql_result($q1,0,"parent"); - $document=mysql_result($q1,0,"document"); - mysql_db_query($DBASE, "delete from $TABLE_MSGS where id=$id"); - mysql_db_query($DBASE, "update $TABLE_MSGS set parent=$parent where parent=$id"); + mysql_query("delete from $TABLE_MSGS where id=$id"); + mysql_query("update $TABLE_MSGS set parent=$parent where parent=$id"); return($subj); endif; };
Index: php-hosts-web/msgboard/message.php diff -u php-hosts-web/msgboard/message.php:1.2 php-hosts-web/msgboard/message.php:1.3 --- php-hosts-web/msgboard/message.php:1.2 Sun Apr 21 20:02:20 2002 +++ php-hosts-web/msgboard/message.php Sun Apr 21 20:42:03 2002 @@ -12,7 +12,7 @@ commonHeader("Message: $section"); title("Message: $section"); -showMessage("show",$subj,$subgroup,$name,$email,$date,$document,$parent,$id); +showMessage("show",$subj,$subgroup,$name,$email,$date,$parent,$id); $q2=mysql($DBASE, "select id from $TABLE_MSGS where parent=$id and subgroup=$subgroup"); if (mysql_numrows($q2)!=0): echo "<TR VALIGN=top><TD align=left colspan=2><FONT FACE=\"$FONTFACE\" SIZE=-1>Follow-ups:<p>\n"; Index: php-hosts-web/msgboard/post.php diff -u php-hosts-web/msgboard/post.php:1.2 php-hosts-web/msgboard/post.php:1.3 --- php-hosts-web/msgboard/post.php:1.2 Sun Apr 21 20:13:59 2002 +++ php-hosts-web/msgboard/post.php Sun Apr 21 20:42:03 2002 @@ -15,21 +15,17 @@ else: title("Post a New Message: ".$groupname); endif; - $time=time(); - $subj=addslashes($subj); - $email=addslashes($email); - $name=addslashes($name); - $query="insert into $TABLE_MSGS values (0,$time,$subgroup,$parent,$type,'$subj','$email','$name',$fileid)"; - echo "<!-- $query -->\n"; - mysql_db_query($DBASE,$query); - $id=mysql_insert_id(); - $newfile="$MSGS/$id"; - if (file_exists($tempfile)): - $command=QuoteMeta("mv $tempfile $newfile"); - exec($command); - endif; + if (!get_magic_quotes_gpc()) { + $subj=addslashes($subj); + $email=addslashes($email); + $name=addslashes($name); + $message = addslashes($message); + } + $query = "INSERT INTO $TABLE_MSGS SET date=NOW(),subgroup=$subgroup,parent=$parent,type=$type,subj='$subj',email='$email',name='$name',message='$message')"; + mysql_query($query); + $id = mysql_insert_id(); echo "<FONT SIZE=+1><b>Message posted.</b></FONT><P>\n"; echo "<CENTER>\n"; @@ -57,9 +53,9 @@ document.forms[0].elements['subj'].focus(); return false ; } - if (document.forms[0].elements['txt'].value == "") { + if (document.forms[0].elements['message'].value == "") { alert("You need to enter something for your message."); - document.forms[0].elements['txt'].focus(); + document.forms[0].elements['message'].focus(); return false ; } return true; @@ -75,16 +71,14 @@ <INPUT TYPE="hidden" NAME="type" value="<? echo $HTML;?>"> <INPUT TYPE="hidden" NAME="subgroup" value=<? echo $subgroup;?> > <input TYPE="hidden" NAME="MAX_FILE_SIZE" VALUE="<? echo $MAX_DOC_SIZE;?>"> -<? +<?php $subj=""; -if(isSet($parent)): +if($parent = (int)$parent) { echo "<input type=\"hidden\" name=\"parent\" value=\"$parent\">"; - $q1=mysql($DBASE,"select subj from $TABLE_MSGS where id=$parent"); - $subj=mysql_result($q1,0,"subj"); - if (!ereg("^Re:",$subj)): + $subj = mysql_get_one("SELECT subj FROM $TABLE_MSGS WHERE id=$parent"); + if (!ereg("^Re:",$subj)) $subj="Re: ".$subj; - endif; -endif; +} ?> <TABLE BORDER=0 cellpadding=5 cellspacing=0 WIDTH=<? echo $TABLE_WIDTH;?> BGCOLOR="<? echo $MSG_FRAME_COLOR;?>"> <TR VALIGN=top BGCOLOR="<? echo $MSG_FRAME_COLOR2;?>"> @@ -106,7 +100,7 @@ </TR> <TR VALIGN=top> <TD ALIGN=right><FONT FACE="<? echo $FONTFACE;?>" SIZE=-1>Message:</TD> -<TD><textarea rows=8 cols=40 name="txt" WRAP="virtual"></textarea><? reqStar();?></TD> +<TD><textarea rows=8 cols=40 name="message" WRAP="virtual"></textarea><? reqStar();?></TD> </TR> <TR VALIGN=top> <TD><BR></TD> Index: php-hosts-web/msgboard/preview.php diff -u php-hosts-web/msgboard/preview.php:1.2 php-hosts-web/msgboard/preview.php:1.3 --- php-hosts-web/msgboard/preview.php:1.2 Sun Apr 21 20:13:59 2002 +++ php-hosts-web/msgboard/preview.php Sun Apr 21 20:42:03 2002 @@ -7,7 +7,7 @@ echo "<FORM><input type=submit value=\" « Go Back \" onClick=\"history.go(-1);\"></FORM>\n"; exit; endif; -if($txt==""): +if($message==""): echo "<B>You need to say <I>something</I>!</B><BR>\n"; echo "<FORM><input type=submit value=\" « Go Back \" onClick=\"history.go(-1);\"></FORM>\n"; exit; @@ -17,18 +17,16 @@ if(!$subj): $subj="(no title)"; endif; -if(!isSet($parent)): - $parent=0; -endif; - -$tempfile = tempnam( "/tmp", "phphosts_" ); -if ($txt!=""): - $fp=fopen($tempfile,"w"); - fputs($fp,$txt); - fclose($fp); -endif; +$parent = (int)$parent; $date=date($DATE_FORMAT); + +if (get_magic_quotes_gpc()) { + $name = stripslashes($name); + $email = stripslashes($email); + $subj = stripslashes($subj); + $message = stripslashes($message); +} ?> <form method=post action="post.php"> <input type=hidden name="mode" value="post"> @@ -37,11 +35,10 @@ <input type=hidden name="name" value="<? qecho($name);?>"> <input type=hidden name="email" value="<? qecho($email);?>"> <input type=hidden name="subj" value="<? qecho($subj);?>"> -<input type=hidden name="tempfile" value="<? echo $tempfile;?>"> +<input type=hidden name="message" value="<? qecho($message);?>"> <input type=hidden name="subgroup" value=<? echo $subgroup;?>> -<input type=hidden name="fileid" value=<? echo $fileid;?>> <? -showMessage("preview",$subj,$subgroup,$name,$email,$date,$fileid,$parent,$txt); +showMessage("preview",$subj,$subgroup,$name,$email,$date,$parent,$message); ?> <TR VALIGN=top BGCOLOR="<? echo $MSG_FRAME_COLOR2;?>"> <TD align=left><input type=button value=" « Go Back " onClick="history.go(-1);"></TD> Index: php-hosts-web/msgboard/shared-msgboard.inc diff -u php-hosts-web/msgboard/shared-msgboard.inc:1.5 php-hosts-web/msgboard/shared-msgboard.inc:1.6 --- php-hosts-web/msgboard/shared-msgboard.inc:1.5 Sun Apr 21 20:17:03 2002 +++ php-hosts-web/msgboard/shared-msgboard.inc Sun Apr 21 20:42:03 2002 @@ -171,7 +171,6 @@ $id=mysql_result($q1,$i,"id"); $date=mysql_result($q1,$i,"date"); $subj=mysql_result($q1,$i,"subj"); - $document=mysql_result($q1,$i,"document"); echo "<TR VALIGN=middle BGCOLOR=\"".$BGCOLOR[$jjj%2]."\">\n"; $jjj++; @@ -217,7 +216,7 @@ -function showMessage ($mode, $subj, $subgroup, $name, $email, $date, $document, $parent, $post) { +function showMessage ($mode, $subj, $subgroup, $name, $email, $date, $parent, $post) { /* * Displays a message (!) */ @@ -239,8 +238,7 @@ echo "<TR VALIGN=top><TD align=right>$FT1 Date:</TD><TD align=left>$FT2<B>$date</B></TD></TR>\n"; if($parent>0): echo "<TR VALIGN=top><TD align=right>$FT1 Follow-Up To:</TD><TD align=left>$FT2"; - $q3=mysql($DBASE, "select subj from $TABLE_MSGS where id=$parent"); - $psubj=mysql_result($q3,0,"subj"); + $psubj = mysql_get_one("SELECT subj FROM $TABLE_MSGS WHERE id=$parent"); if ($mode=="preview"): echo "<B>$psubj</B></TD></TR>\n"; else: @@ -251,10 +249,10 @@ endif; echo "<TR VALIGN=top BGCOLOR=\"$MSG_TEXT_COLOR\"><TD colspan=2>$FT2\n"; if ($mode=="preview"): - echo nl2br($post); + echo nl2br(htmlentities($post)); else: $show = mysql_get_one("SELECT message FROM $TABLE_MSGS WHERE id=$post"); - echo nl2br($show); + echo nl2br(htmlentities($show)); endif; echo "</TD></TR>\n"; }; @@ -272,17 +270,16 @@ /* * Deletes a posted message, and any attachments */ - global $MSGS, $DOCS, $DBASE, $TABLE_MSGS, $TABLE_DOCS; - $q1=@mysql_db_query($DBASE, "select * from $TABLE_MSGS where id=$id"); + global $MSGS, $TABLE_MSGS; + $q1=@mysql_query("select * from $TABLE_MSGS where id=$id"); if(mysql_numrows($q1)!=1 || $q1==-1): echo "<FONT COLOR=\"#800000\">Error: ".mysql_error()."<BR>Message $id not deleted.</FONT><BR>\n"; return(-1); else: $subj=mysql_result($q1,0,"subj"); $parent=mysql_result($q1,0,"parent"); - $document=mysql_result($q1,0,"document"); - mysql_db_query($DBASE, "delete from $TABLE_MSGS where id=$id"); - mysql_db_query($DBASE, "update $TABLE_MSGS set parent=$parent where parent=$id"); + mysql_query("delete from $TABLE_MSGS where id=$id"); + mysql_query("update $TABLE_MSGS set parent=$parent where parent=$id"); return($subj); endif; };