Файл: vxas.ru/anka/frend_new.php
Строк: 152
<?php
$corec = $_SERVER['DOCUMENT_ROOT'];
require_once $corec.'/sys/inc/core.php';
only_reg();
$ank['id'] = mysql_real_escape_string($user['id']);
if(isset($_GET['ok'])){
$ok = intval($_GET['ok']);
if(mysql_result(mysql_query("SELECT COUNT(*) FROM `user` WHERE `id` = '".mysql_real_escape_string($ok)."' LIMIT 1"),0)==0){
header("Location: /index.php");
exit;
}
mysql_query("INSERT INTO `frends` (`user`, `frend`, `time`, `i`) values('".mysql_real_escape_string($ank['id'])."', '".mysql_real_escape_string($ok)."', '".mysql_real_escape_string($time)."', '1')");
mysql_query("INSERT INTO `frends` (`user`, `frend`, `time`, `i`) values('".mysql_real_escape_string($ok)."', '".mysql_real_escape_string($ank['id'])."', '".mysql_real_escape_string($time)."', '1')");
mysql_query("DELETE FROM `frends_new` WHERE `user` = '".mysql_real_escape_string($ok)."' AND `to` = '".mysql_real_escape_string($user['id'])."' LIMIT 1");
mysql_query("DELETE FROM `frends_new` WHERE `user` = '".mysql_real_escape_string($user['id'])."' AND `to` = '".mysql_real_escape_string($ok)."' LIMIT 1");
$msgok = 'Поздравляем! обитатель [b]'.htmlspecialchars($user['nick']).'[/b] принял ваше предложение дружбы';
mysql_query("INSERT INTO `jurnal` (`id_user`, `id_kont`, `msg`, `time`) values('0', '".mysql_real_escape_string($ok)."', '".mysql_real_escape_string($msgok)."', '".mysql_real_escape_string($time)."')");
mysql_query("OPTIMIZE TABLE `frends`, `frends_new`, `jurnal`");
header("Location: frend.php");
exit;
}
if(isset($_GET['no'])){
$no = intval($_GET['no']);
if(mysql_result(mysql_query("SELECT COUNT(*) FROM `user` WHERE `id` = '".mysql_real_escape_string($no)."' LIMIT 1"),0)==0){
header("Location: /index.php");
exit;
}
mysql_query("DELETE FROM `frends` WHERE `user` = '".mysql_real_escape_string($user['id'])."' AND `frend` = '".mysql_real_escape_string($no)."' LIMIT 1");
mysql_query("DELETE FROM `frends` WHERE `user` = '".mysql_real_escape_string($no)."' AND `frend` = '".mysql_real_escape_string($user['id'])."' LIMIT 1");
mysql_query("DELETE FROM `frends_new` WHERE `user` = '".mysql_real_escape_string($no)."' AND `to` = '".mysql_real_escape_string($user['id'])."' LIMIT 1");
mysql_query("DELETE FROM `frends_new` WHERE `user` = '".mysql_real_escape_string($user['id'])."' AND `to` = '".mysql_real_escape_string($no)."' LIMIT 1");
$msgno = 'К сожалению, обитатель [b]'.htmlspecialchars($user['nick']).'[/b] отказал вам в предложение дружбы!';
mysql_query("INSERT INTO `jurnal` (`id_user`, `id_kont`, `msg`, `time`) values('0', '".mysql_real_escape_string($no)."', '".mysql_real_escape_string($msgno)."', '".mysql_real_escape_string($time)."')");
mysql_query("OPTIMIZE TABLE `frends`, `frends_new`, `jurnal`");
header("Location: frend_new.php");
exit;
}
if(isset($_GET['del'])){
$no = intval($_GET['del']);
if(mysql_result(mysql_query("SELECT COUNT(*) FROM `user` WHERE `id` = '".mysql_real_escape_string($no)."' LIMIT 1"),0)==0){
header("Location: /index.php");
exit;
}
mysql_query("DELETE FROM `frends` WHERE `user` = '".mysql_real_escape_string($user['id'])."' AND `frend` = '".mysql_real_escape_string($no)."' LIMIT 1");
mysql_query("DELETE FROM `frends` WHERE `user` = '".mysql_real_escape_string($no)."' AND `frend` = '".mysql_real_escape_string($user['id'])."' LIMIT 1");
mysql_query("DELETE FROM `frends_new` WHERE `user` = '".mysql_real_escape_string($no)."' AND `to` = '".mysql_real_escape_string($user['id'])."' LIMIT 1");
mysql_query("DELETE FROM `frends_new` WHERE `user` = '".mysql_real_escape_string($user['id'])."' AND `to` = '".mysql_real_escape_string($no)."' LIMIT 1");
$msgno = 'К сожалению, обитатель [b]'.htmlspecialchars($user['nick']).'[/b] удалил вас из списка друзей!';
mysql_query("INSERT INTO `jurnal` (`id_user`, `id_kont`, `msg`, `time`) values('0', '".mysql_real_escape_string($no)."', '".mysql_real_escape_string($msgno)."', '".mysql_real_escape_string($time)."')");
mysql_query("OPTIMIZE TABLE `frends`, `frends_new`, `jurnal`");
header("Location: frend.php");
exit;
}
$set['title'] = 'Список предложений дружбы & '.$_SERVER['HTTP_HOST'];
require_once $corec.'/sys/inc/thead.php';
title();
if($ank['id']==$user['id']){
?><div class='ankus'># <a href="frend.php">Мои друзья</a></div><?
}
$m = date('m',$time);
if(substr($m,0,1)==0){
$m = str_replace('0','',$m);
}
$d = date('d',$time);
$k_f = mysql_result(mysql_query("SELECT COUNT(id) FROM `frends_new` WHERE `to` = '".mysql_real_escape_string($user['id'])."' LIMIT 1"),0);
if($k_f==0){
?><div class="ankus">Нет предложений на дружбу</div><?
}
$q = mysql_query("SELECT * FROM `frends_new` WHERE `to` = '".mysql_real_escape_string($user['id'])."' ORDER BY time DESC");
while($f = mysql_fetch_array($q)){
$a = mysql_fetch_array(mysql_query("SELECT * FROM `user` WHERE `id` = '".mysql_real_escape_string($f['user'])."' LIMIT 1"));
?><div class="ankus"><tr><td class="ankus" ><?
echo avatar2($a['id']);
echo '</td><td class="ankus"><a href="/info.php?id='.htmlspecialchars($a['id']).'">'.htmlspecialchars($a['nick']).'</a> ('.vremja($f['time']).')<br/>';
echo '<a href="frend_new.php?ok='.htmlspecialchars($a['id']).'">Принять</a> / <a href="frend_new.php?no='.htmlspecialchars($a['id']).'">Отклонить</a></td></tr></div>';
}
?></div><?
require_once $corec.'/sys/inc/tfoot.php';
?>