richard

<?phpinclude_once ('db_fns.php');/// is the user logged in as admin..function is_admin() {	if(isSet($_SESSION['admin'])) {		if($_SESSION['admin']=="yes")			return TRUE;	}	return FALSE;}function logout() {	unset($_SESSION['admin']);}function do_login_form() {	$user="";	if(isset($_POST['user'])) {		$user=$_POST['user'];		if(isSet($_POST['pass'])) {			// try the login...			$query=sprintf("SELECT * FROM admin WHERE user='%s' AND pass='%s';",mysql_escape_string($_POST['user']),mysql_escape_string($_POST['pass']));			$result = mysql_query($query) or die(mysql_error());			if(mysql_num_rows($result) == 1) {				$_SESSION['admin']="yes";				mysql_free_result($result);				print '<h3>Logged in as admin.</h3>';				return;			}			mysql_free_result($result);			print '<h2>Incorrect username or password</h2>';		}	}	?>	<form class="login" method="post">	<table border=0>	<tr><th>Username</th><td><input type="text" width="50" name="user" value="<?php echo $user; ?>" /></td></tr>	<tr><th>Password</th><td><input type="password" width="50" name="pass" value="" /></td></tr>	<tr><td colspan="2"><input type="submit" value="Login" /></td></tr>	</table>	</form>	<?php}function edit_form($item) {	if(!is_admin()) {		echo '<h3> You are not allowed to edit items...</h3>';		return;	}	if(isSet($_POST['title'])) {		$title=$_POST['title'];		$body=$_POST['body'];		$price=$_POST['price'];	} else if($item != FALSE) {		$p=find_product($item);		$title=$p['title'];		$body=$p['body'];		$price=$p['price'];	} else {		$title='';		$body='';		$price='';	}?><form class="edititem" method="post" ><!-- <form class="edititem" method="post" enctype="multipart/form-data"> --><table border=0><input type="hidden" name="MAX_FILE_SIZE" value="2000000" /><tr><th>Title</th><td><input type="text" width="50" name="title" value="<?php echo $title; ?>" /></td></tr><tr><th>Price</th><td><input type="text" width="50" name="price" value="<?php echo $price; ?>" /></td></tr><tr><th>Body</th><td><textarea cols="50" rows="5" name="body" ><?php echo $body; ?></textarea></td></tr><!-- <tr><th>Image</th><td><input type="file" width=50 name="img" /></td></tr> --><tr><th>Image</th><td><input type="text" width=50 name="img" /></td></tr><tr><td colspan="2"><input type="submit" value="Update item" /></td></tr></table></form><?php}function validate_item($arr) {	$err = array();	if(strlen($arr['title'])<1) {		array_push($err,"Title too short");	}	if(intval($arr['price'])==0) {		array_push($err,"Invalid price");	}	if(strlen($arr['body'])<1) {		array_push($err,"body text too short");	}	if(strlen($arr['img'])<1) {		array_push($err,"image not set ");	}	if(count($err)==0)	return FALSE;	return $err;}function update_item($id,$data) {}function doedit() {	$item = $_GET['edititem'];	if(isSet($_POST['title'])) {	// if the form has already been submitted...	$err = validate_item($_POST);	   print_r($err);		if($err==FALSE) {			update_item($item,$_POST);		} else {			print "<h2>Errors:</h2>\n<ul>";			foreach($err as $i ) {				printf("<li>%s</li>\n",$i);			}			print "</ul>";			edit_form($FALSE);		}	} else {		edit_form($id);	}}// session_start();// db_connect();// if(!is_admin())// do_login_form();// print 'session.admin='.$_SESSION['admin'];// edit_form(2);?>