VisualEyes-5/saveshow.php at master · bferster/VisualEyes-5 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
<?php
header('Cache-Control: no-cache, no-store, must-revalidate');
header('Expires: Sun, 01 Jul 2005 00:00:00 GMT');
header('Pragma: no-cache');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Max-Age: 1000');
require_once('config7.php');

	$id="";
	$password="";
	$email="";
	$title="";
	$script="";
	$private='0';
	$deleted='0';
	$ver=0;

	$email=$_REQUEST['email'];									// Get email
	$password=$_REQUEST['password'];							// Get password

	if (isSet($_REQUEST['id'])) 								// If set
		$id=$_REQUEST['id'];									// Get it
	if (isSet($_REQUEST['title'])) 								// If setzzzz
		$title=$_REQUEST['title'];								// Get it
	if (isSet($_REQUEST['script'])) 							// If set
		$script=$_REQUEST['script'];							// Get it
	if (isSet($_REQUEST['private'])) 							// If set
		$private=$_REQUEST['private'];							// Get it
	if (isSet($_REQUEST['deleted'])) 							// If set
		$deleted=$_REQUEST['deleted'];							// Get it
	if (isSet($_REQUEST['ver'])) 								// If set
		$ver=$_REQUEST['ver'];									// Get it

	$id=addEscapes($link,$id);									// Escape id
	$query="SELECT * FROM qshow WHERE id = '".$id."'"; 			// Look existing one
	$result=mysqli_query($link, $query);						// Run query
	if ($result == false) {										// Bad query
		print("-1");											// Show error
		mysqli_close($link);									// Close session
		exit();													// Quit
		}
	if (!mysqli_num_rows($result)) {							// If not found, add it
		$query="INSERT INTO qshow (title, script, email, password, version, private) VALUES ('";
		$query.=addEscapes($link,$title)."','";
		$query.=addEscapes($link,$script)."','";
		$query.=addEscapes($link,$email)."','";
		$query.=addEscapes($link,$password)."','";
		$query.=addEscapes($link,$ver)."','";
		$query.=addEscapes($link,$private)."')";
		$result=mysqli_query($link, $query);					// Run query
		if ($result == false)									// Bad save
			print("-2");										// Show error
		else
			print(mysqli_insert_id($link)."\n");				// Return ID of new resource
		}
	else{														// We have one already
		$row=mysqli_fetch_assoc($result);						// Get row
		$oldpass=$row["password"];								// Get old password
		if ($oldpass && ($password != $oldpass)) {				// Passwords don't match
			print("-3");										// Show error
			mysqli_free_result($result);						// Free
			mysqli_close($link);								// Close session
			exit();												// Quit
			}
		if (!isSet($_REQUEST['title'])) 						// If not set
			$title=$row["title"];								// Get from POST
		if (!isSet($_REQUEST['script'])) 						// If not set
			$script=$row["script"];								// Get from POST
		if (!isSet($_REQUEST['private'])) 						// If not set
			$private=$row["private"];							// Get from POST
		if (!isSet($_REQUEST['deleted'])) 						// If not set
			$deleted=$row["deleted"];							// Get from POST

		$id=$row["id"];											// Get id
		$id=addEscapes($link,$id);								// Escape id
		if ($id != "") {										// If valid
			$query="UPDATE qshow SET title='".addEscapes($link,$title)."' WHERE id = '".$id."'";
			$result=mysqli_query($link, $query);				// Run query
			$query="UPDATE qshow SET script='".addEscapes($link,$script)."' WHERE id = '".$id."'";
			$result=mysqli_query($link, $query);				// Run query
			$query="UPDATE qshow SET private='".addEscapes($link,$private)."' WHERE id = '".$id."'";
			$result=mysqli_query($link, $query);				// Run query
			$query="UPDATE qshow SET deleted='".addEscapes($link,$deleted)."' WHERE id = '".$id."'";
			$result=mysqli_query($link, $query);				// Run query
			$query="UPDATE qshow SET date='".date("Y-m-d H:i:s")."' WHERE id = '".$id."'";
			$result=mysqli_query($link, $query);				// Run query
			}
		if ($result == false)									// Bad update
			print("-4");										// Show error
		else
			print($id);											// Show id
		}														// End if valid

	mysqli_close($link);									// Close session


	function addEscapes($lnk, $str)								// ESCAPE ENTRIES
	{
		if (!$str)												// If nothing
			return $str;										// Quit
		$str=mysqli_real_escape_string($lnk, $str);				// Add slashes
		$str=str_replace("\r","", $str);						// No crs
		return $str;
	}

?>