Unnamed

case "addbooking":	//So far this doesn't take into account times for bookings	//Start to sanitize the data...		if (!$_POST['submit']) 		{ 			die("Attempted XSS Attack."); 		} 		else 		{			$airlines = mysql_escape_string($_POST['airlines']);			$requester = mysql_escape_string($_POST['requester']); 		}				if (!is_numeric($_POST['requestcontact']) || !isset($_POST['requestcontact']))		{ 			die("Phone Number must be entered in numbers only"); 		}		else 		{ 			$contact = mysql_escape_string($_POST['requestcontact']); 		}				//Create a MYSQL Friendly Start/End/Non-Range Date for entry into the database		if ( $_POST['range'] != "y" && $_POST['range'] != "n" )		{			die ("Range Question not answered");		}				if ( $_POST['range'] == "y" ) 		{ 			$startdate = intval($_POST['startbookyear']) .'-'. intval($_POST['startbookmonth']) .'-'. intval($_POST['startbookday']);			$enddate = intval($_POST['endbookyear']) .'-'. intval($_POST['endbookmonth']) .'-'. intval($_POST['endbookday']);			$starttime = intval($_POST['rangestarthour']) .':'. intval($_POST['rangestartmin']) .':00';			$endtime = intval($_POST['rangeendhour']) .':'. intval($_POST['rangeendmin']) .':00';			$starttimeTS = mktime($_POST['rangestarthour']), $_POST['rangestartmin'],'00');			$endtimeTS = mktime($_POST['rangeendhour'], $_POST['rangeendmin'],'00');			$rangeTSStart = mktime(0,0,0, $_POST['startbookmonth'], $_POST['startbookday'], $_POST['startbookyear']);			$rangeTSEnd = mktime(0,0,0, $_POST['endbookmonth'], $_POST['endbookday'], $_POST['endbookyear']);			$rangebook = "y";			$requestdate = date("Y-m-d H:i:s", $rangeTSStart);		}		else 		{ 			$date = intval($_POST['bookyear']) .'-'. intval($_POST['bookmonth']) .'-'. intval($_POST['bookday']);			$starttime = intval($_POST['starthour']) .':'. intval($_POST['startmin']) .':00';			$endtime = intval($_POST['endhour']) .':'. intval($_POST['endmin']) .':00';			$bookTS = mktime(0,0,0, $_POST["bookmonth"], $_POST["bookday"], $_POST["bookyear"]);			$rangebook = "n";			$requestdate = date("Y-m-d H:i:s", $bookTS);			$starttimeTS = mktime($_POST['starthour'], $_POST['startmin'],'00');			$endtimeTS = mktime($_POST['endhour'], $_POST['endmin'],'00');		}				$notes = mysql_escape_string($_POST['notes']);				//And here we go.. Starting the MySQL Connection		$link = mysql_connect('localhost', 'roombook', 'roombook'); 		if (!$link) 		{			die("Could not connect to MySQL Server ". mysql_error());		}		$result = mysql_select_db('roombook', $link); 				if(!$result)		{			die('Could not select database.');		}				//New Code		$chksql = 'SELECT * FROM bookings WHERE bookdate = "'. $requestdate .'"';		$checkExists = mysql_query($chksql);		$add = true;		while ($row = mysql_fetch_array($checkExists) && $add == true) 		{ //Retrieve All records for said Date			$newstarttime = $row['starttime'];			$tss = explode(":", $newstarttime);			$tsstart = mktime($tss[0],$tss[1],$tss[2]);						//existing end time to timestamp			$newendtime = $row['endtime'];			$tse = explode(":", $newendtime);			$tsend = mktime($tse[0],$tse[1],$tse[2]);						if (($starttimeTS < $tsstart) && ($endtimeTS <= $tsstart) && ($starttimeTS < $endtimeTS)) 			{				$add = true;			} 			elseif (($starttimeTS >= $tsend) && ($endtimeTS > $tsend) && ($endtimeTS > $starttimeTS)) 			{				$add = true;			} 			else 			{ 				$add = false; 			}		}		if ($add == true) 		{			if ($rangebook == 'y') 			{				$i = $rangeTSStart;				$j = $rangeTSEnd;				$sql1 = 'SELECT `rangeID` FROM bookings ORDER BY `rangeID` DESC LIMIT 1';				$result = mysql_query($sql1);				if (!$result) 				{ 					die("Could not query Database ". mysql_error()); 				}				else 				{ 					$oldID = mysql_result($result,0); 					$rangeID = ($oldID+1); unset($oldID); 				}								while ( $i <= $j ) 				{					$bookingdate = date("Y-m-d H:i:s", $i); 					$sql = 'INSERT INTO bookings (rangeID,airline,requester,contact,range,bookdate,starttime,endtime,notes) VALUES ("'. $rangeID . '","'. $airlines .'","'. $requester. '",'. $contact .',"y","'. $bookingdate .'","'. $starttime .'","'. $endtime .'","'. $notes .'")';					$result = mysql_query($sql);					if (!$result) 					{ 						die("Could not query Database ". mysql_error()); 					} 					else 					{						$i = mktime(0,0,0,date("m", $i),date("d",$i)+1,date("Y",$i));					}				}				echo '<div id="centerColumn">Booking added sucessfully!<br /><br />Click <a href="index.php?mode=home">Here</a> to go Home or <a href="index.php?mode=add">Here</a> to add a new booking</div><body></html>';							} 			else 			{				$bookingdate = date("Y-m-d H:i:s", $bookTS);				$sql = 'INSERT INTO bookings (airline,requester,contact,range,bookdate,starttime,endtime,notes) VALUES ("'. $airlines .'","'. $requester. '",'. $contact .',"n","'. $bookingdate .'","'. $starttime .'","'. $endtime .'","'. $notes .'")';				$result = mysql_query($sql);				if (!$result) 				{ 					die ("Could not query Database ". mysql_error()); 				} 				else 				{					echo '<div id="centerColumn">Booking added sucessfully!<br /><br />Click <a href="index.php?mode=home">Here</a> to go Home or <a href="index.php?mode=add">Here</a> to add a new booking</div><body></html>';				} //else			} //else		} 		else 		{ 			die ("Selected Date Not Available. Please Try Again"); 		}			//this might be a spare }. If you get an error, try removing it!	} //parent if	break;