Anonymous

<?php

include ("config/config.php");
session_start();
if ($_GET['exporttype']==""){
echo "No Valid Input Detected";
die;
}elseif ($_GET['exporttype']=="closed") {
$select = "SELECT a.id, a.itemname, a.description, c.name, a.bidstart, a.rpvalue, a.bnvalue, a.startdate, a.enddate, a.postage_costs FROM probid_auctions WHERE a.category=c.id AND ownerid = '".$_SESSION['memberid']."' AND closed=1 AND deleted!=1";
}elseif ($_GET['exporttype']=="open") {
$select = "SELECT a.id, a.itemname, a.description, c.name, a.bidstart, a.rpvalue, a.bnvalue, a.enddate, a.postage_costs FROM probid_auctions WHERE a.category=c.id AND ownerid = '".$_SESSION['memberid']."' AND closed!=1 AND active=1 AND deleted!=1";
}elseif ($_GET['exporttype']=="sold") {
$select = "SELECT u.username, u.email, w.amount, a.id, a.itemname, c.name, a.enddate, a.postage_costs FROM probid_winners w, probid_auctions a, probid_users u, probid_categories c WHERE a.category=c.id AND w.sellerid='".$_SESSION['memberid']."' AND a.id=w.auctionid AND u.id=w.buyerid AND w.s_deleted!=1";
}elseif ($_GET['exporttype']=="all") {
$select = "SELECT a.id, a.itemname, a.description, c.name, a.bidstart, a.rpvalue, a.bnvalue, a.startdate, a.enddate, a.postage_costs FROM probid_auctions a, probid_categories c WHERE a.category=c.id AND ownerid = '".$_SESSION['memberid']."'";
}else{
echo "No Valid Input Detected";
die;
}
$export = mysql_query ( $select ) or die ( "Sql error : " . mysql_error( ) );

$fields = mysql_num_fields ( $export );

for ( $i = 0; $i < $fields; $i++ )
{
    $header .= mysql_field_name( $export , $i ) . "\t";
    $header = str_replace("username","buyer userid", $header);
    $header = str_replace("itemname","auction title", $header);
    $header = str_replace("bidstart","start price", $header);
    $header = str_replace("rpvalue","reserve price", $header);
    $header = str_replace("bnvalue","buynow price", $header);
    $header = str_replace("name","category", $header);
}

while( $row = mysql_fetch_row( $export ) )
{	 
 	$row['category']= getSqlField("SELECT name FROM probid_categories WHERE id='".$row['category']."'", name);
    $line = '';
    foreach( $row as $value )
    {   
        $value = str_replace( "," , " " , $value );
        if ( ( !isset( $value ) ) || ( $value == "" ) )
        {
            $value = "\t";
        }
        else
        {
            $value = str_replace( '"' , '""' , $value );
            $value = '"' . $value . '"' . "\t";
        }
        $line .= $value;
    }
    $data .= trim( $line ) . "\n";
}
 
$data = str_replace( "\r" , "" , $data );
$data = strip_tags($data);
$data = html_entity_decode($data, ENT_QUOTES);
$data= str_replace( ";" , " " , $data );
$fn = "WebuyExport";
$fn .= $_GET['exporttype'];
$fn.= "_auctions";
$fn .= date(dmy);
$fn .= ".csv";
if ( $data == "" )
{
    echo "\nNo Auctions Found!\n";
    die;                        
}

header("Content-type: application/octet-stream");
header("Content-Disposition: attachment; filename=$fn");
header("Pragma: no-cache");
header("Expires: 0");
print "$header\n$data";
?>