rendered paste bodycase "addbooking": //So far this doesn't take into account times for bookings //Start to sanitize the data... if (!$_POST['submit']) { die("Attempted XSS Attack."); } else { $airlines = mysql_escape_string($_POST['airlines']); $requester = mysql_escape_string($_POST['requester']); if (!is_numeric($_POST['requestcontact']) || !isset($_POST['requestcontact'])) { die("Phone Number must be entered in numbers only"); } else { $contact = mysql_escape_string($_POST['requestcontact']); } //Create a MYSQL Friendly Start/End/Non-Range Date for entry into the database if ( $_POST['range'] != "y" && $_POST['range'] != "n" ) { die ("Range Question not answered"); } if ( $_POST['range'] == "y" ) { $startdate = intval($_POST['startbookyear']) .'-'. intval($_POST['startbookmonth']) .'-'. intval($_POST['startbookday']); $enddate = intval($_POST['endbookyear']) .'-'. intval($_POST['endbookmonth']) .'-'. intval($_POST['endbookday']); $starttime = intval($_POST['rangestarthour']) .':'. intval($_POST['rangestartmin']) .':00'; $endtime = intval($_POST['rangeendhour']) .':'. intval($_POST['rangeendmin']) .':00'; $starttimeTS = mktime($_POST['rangestarthour']), $_POST['rangestartmin'],'00'); $endtimeTS = mktime($_POST['rangeendhour'], $_POST['rangeendmin'],'00'); $rangeTSStart = mktime(0,0,0, $_POST['startbookmonth'], $_POST['startbookday'], $_POST['startbookyear']); $rangeTSEnd = mktime(0,0,0, $_POST['endbookmonth'], $_POST['endbookday'], $_POST['endbookyear']); $rangebook = "y"; $requestdate = date("Y-m-d H:i:s", $rangeTSStart); } else { $date = intval($_POST['bookyear']) .'-'. intval($_POST['bookmonth']) .'-'. intval($_POST['bookday']); $starttime = intval($_POST['starthour']) .':'. intval($_POST['startmin']) .':00'; $endtime = intval($_POST['endhour']) .':'. intval($_POST['endmin']) .':00'; $bookTS = mktime(0,0,0, $_POST["bookmonth"], $_POST["bookday"], $_POST["bookyear"]); $rangebook = "n"; $requestdate = date("Y-m-d H:i:s", $bookTS); $starttimeTS = mktime($_POST['starthour'], $_POST['startmin'],'00'); $endtimeTS = mktime($_POST['endhour'], $_POST['endmin'],'00'); } $notes = mysql_escape_string($_POST['notes']); //And here we go.. Starting the MySQL Connection $link = mysql_connect('localhost', 'roombook', 'roombook'); if (!$link) { die("Could not connect to MySQL Server ". mysql_error()); } $result = mysql_select_db('roombook', $link); if(!$result) { die('Could not select database.'); } //New Code $chksql = 'SELECT * FROM bookings WHERE bookdate = "'. $requestdate .'"'; $checkExists = mysql_query($chksql); $add = true; while ($row = mysql_fetch_array($checkExists) && $add == true) { //Retrieve All records for said Date $newstarttime = $row['starttime']; $tss = explode(":", $newstarttime); $tsstart = mktime($tss[0],$tss[1],$tss[2]); //existing end time to timestamp $newendtime = $row['endtime']; $tse = explode(":", $newendtime); $tsend = mktime($tse[0],$tse[1],$tse[2]); if (($starttimeTS < $tsstart) && ($endtimeTS <= $tsstart) && ($starttimeTS < $endtimeTS)) { $add = true; } elseif (($starttimeTS >= $tsend) && ($endtimeTS > $tsend) && ($endtimeTS > $starttimeTS)) { $add = true; } else { $add = false; } } if ($add == true) { if ($rangebook == 'y') { $i = $rangeTSStart; $j = $rangeTSEnd; $sql1 = 'SELECT `rangeID` FROM bookings ORDER BY `rangeID` DESC LIMIT 1'; $result = mysql_query($sql1); if (!$result) { die("Could not query Database ". mysql_error()); } else { $oldID = mysql_result($result,0); $rangeID = ($oldID+1); unset($oldID); } while ( $i <= $j ) { $bookingdate = date("Y-m-d H:i:s", $i); $sql = 'INSERT INTO bookings (rangeID,airline,requester,contact,range,bookdate,starttime,endtime,notes) VALUES ("'. $rangeID . '","'. $airlines .'","'. $requester. '",'. $contact .',"y","'. $bookingdate .'","'. $starttime .'","'. $endtime .'","'. $notes .'")'; $result = mysql_query($sql); if (!$result) { die("Could not query Database ". mysql_error()); } else { $i = mktime(0,0,0,date("m", $i),date("d",$i)+1,date("Y",$i)); } } echo '<div id="centerColumn">Booking added sucessfully!<br /><br />Click <a href="index.php?mode=home">Here</a> to go Home or <a href="index.php?mode=add">Here</a> to add a new booking</div><body></html>'; } else { $bookingdate = date("Y-m-d H:i:s", $bookTS); $sql = 'INSERT INTO bookings (airline,requester,contact,range,bookdate,starttime,endtime,notes) VALUES ("'. $airlines .'","'. $requester. '",'. $contact .',"n","'. $bookingdate .'","'. $starttime .'","'. $endtime .'","'. $notes .'")'; $result = mysql_query($sql); if (!$result) { die ("Could not query Database ". mysql_error()); } else { echo '<div id="centerColumn">Booking added sucessfully!<br /><br />Click <a href="index.php?mode=home">Here</a> to go Home or <a href="index.php?mode=add">Here</a> to add a new booking</div><body></html>'; } //else } //else } else { die ("Selected Date Not Available. Please Try Again"); } } //parent if break;