rendered paste body<?php ob_start(); ?><html><head><title>~:: Mad Banana ::~</title></head><body><?php include('../header.php'); ?> <?phpif(isset($_COOKIE['username'])){if(isset($_POST['submitted'])){ $um = $_COOKIE['username'];$um = mysql_real_escape_string($um);if($level_is != 1){$date_now = date('Y-m-d');$get_number = mysql_query("SELECT * FROM uploads WHERE username='$um' && date='$date_now%'");$count_it = mysql_num_rows($get_number);if($count_it >= 2){echo "It looks like you have already submitted 2 submissions today. Why don't you lay off the submission submitting and wait 'til tomorrow.";include("../footer.php");exit;}}$name = htmlentities($_POST['name']);$comment = $_POST['comments'];$comment = htmlentities($comment);$comment = trim($comment);$type = $_POST['type'];$description = $_POST['description'];$description = htmlentities($description);$width = $_POST['width'];$height = $_POST['height'];$credits = $_POST['credits'];$name = mysql_real_escape_string($name);$comment = mysql_real_escape_string($comment);$type = mysql_real_escape_string($type);$description = mysql_real_escape_string($description);$width = mysql_real_escape_string($width);$height = mysql_real_escape_string($height);$credits = mysql_real_escape_string($credits);$get_uid = mysql_fetch_array(mysql_query("SELECT * FROM users WHERE username='$um'"));$author = $get_uid['id'];$num_uploads = $get_uid['media_uploads'];$num_ups = $num_uploads + 1;$uploaddir = $_SERVER['DOCUMENT_ROOT'] . '/media/view'; $allowed_ext = "swf"; $max_size = "5242880"; /// in Bytes$max_height = "2000"; $max_width = "2000"; $this_file = $_FILES['file']['tmp_name'];$check = mysql_num_rows(mysql_query("SELECT * FROM uploads WHERE name = '$name'"));///// Get the extensions allowed (.swf) and put them into effect$extension = pathinfo($_FILES['file']['name']);$extension = $extension[extension];$allowed_paths = explode(", ", $allowed_ext);for($i = 0; $i < count($allowed_paths); $i++) { if ($allowed_paths[$i] == "$extension") { $ok = "1"; }}if ($ok == "1") { if($_FILES['file']['size'] > $max_size){ echo "File size is too big! It can only be 5MB. Your's was" . $_FILES['file']['size'] / 1000000 . ""; include ('../footer.php'); exit; } if ($width && $height){ if($width > $max_width || $height > $max_height){ echo "File height and/or width are too big! Width and Height can only be 2000 pixels. Your file was $width x $height"; include ('../footer.php'); exit; } } if($check > 0){ echo 'Error! Please name your submission something else, because "<strong>' . $name . '</strong>" has already been taken. <a href="javascript:history.back();">Go back</a>'; include('../footer.php'); exit(); } $_FILES['file']['name'] = strip_tags($_FILES['file']['name']); $_FILES['file']['name'] = addslashes($_FILES['file']['name']); $filename = stripslashes(strtolower(str_replace(' ','_',$_FILES['file']['name']))); $filename = htmlentities($filename); $path = $uploaddir; $path .= "/"; $path .= $id; $path .= "_"; $path .= $filename; $file_size = $_FILES['file']['size']; $date_today = date('m/d/y');$query = "INSERT INTO uploads (name, author, comment, description, date, width, height, credits, type, icon, filesize, date_today) VALUES ('$name', '$author', '$comment', '$description', NOW(), '$width', '$height', '$credits', '$type','$filename4', '$file_size', '$date_today')"; $result = mysql_query($query) or die ('Error1! <b>' . mysql_error() . '</b>'); $name = mysql_real_escape_string($name); $result = mysql_query("SELECT id FROM uploads WHERE name='$name'") or die('error2 ' . mysql_error()); $row = mysql_fetch_array($result); $id = $row['id']; $uploaddir = $_SERVER['DOCUMENT_ROOT'] . '/media/view'; $path = $uploaddir; $path .= "/"; $path .= $id; $path .= "_"; $path .= $filename; move_uploaded_file($_FILES['file']['tmp_name'], $path) or die('Upload failed!');/////////////////$id = mysql_real_escape_string($id);$filename = $id.'_'.$filename;$query = "UPDATE uploads SET filename='$filename' WHERE id='$id'";$result = mysql_query($query) or die ('Error3! <b>' . mysql_error() . '</b>');$query2 = mysql_query("UPDATE users SET media_uploads = media_uploads+1 WHERE id='$author'");////////////////////$pg = '/media/portal/'.$id;header("Location: $pg");echo "<center>File uploaded successfully! It can be found <a href=\"/media/portal/$id\">Right Here</a></center>";echo '<br /><br />';}else{echo "Incorrect file extension! You must use the Shockwave Format (.swf).";}}else{ echo 'You need to <a href="/mad/login.php">login</a> first before you can upload content!';}include('../footer.php');?>