Anonymous

<?php
session_start();
// Coded by Starholdest/Elliott Gervais Copyright © 2006-2007
require("../sources/connect.php");
$user = $_SESSION['user'];
$title = mysql_real_escape_string($_POST['title']);
$author = mysql_real_escape_string($_POST['author']);
$bookid = mysql_real_escape_string($_POST['bookid']);

$titlestripped = stripslashes(($title));
?>

<head><title>Add books - Admin CP</title><link rel="stylesheet" type="text/css" href="../sources/style.css"></head>
<div id="bigbox">
<div id="maintext">
<title>Add a book</title>

<?php
$result = mysql_query("SELECT * FROM `users` WHERE `username`='$user'");
$row = mysql_fetch_array($result);
if(!isset($user) OR $row['groupid'] == 2) die("You're not logged in!<br /><a href=\"./index.php\">Login here</a>");
?>
<h1>Add books</h1>
<?php
if(!$_POST) {
?>
    <form method="POST" action="">
    Title: <input type="text" name="title" size="50" maxlength="100"><br/>
    Author: <input type="text" name="author" size="50" maxlength="100"><br/>
    Book ID: <input type="text" name="bookid" size="5" maxlength="32"><br/><br/>
    <input type="submit" value="Add book"></form>
<?php
}elseif($title && $author && $bookid) {
  if (is_numeric($_POST['bookid'])) {
    $result = mysql_query("SELECT * FROM `books` WHERE `title`='$title'");
    $numrows = mysql_num_rows($result);
    $result2 = mysql_query("SELECT * FROM `books` WHERE `bookid`='$bookid'");
    $numrows2 = mysql_num_rows($result2);
    
		if ($numrows > 0) {
?>
			<form method="POST" action="">
			Title: <input type="text" name="title" size="50" maxlength="100"><br/>
			Author: <input type="text" name="author" size="50" maxlength="100"><br/>
			Book ID: <input type="text" name="bookid" size="5" maxlength="32"><br/><br/>
			<input type="submit" value="Add book"></form>
			<div id="errortext">There is another book in the database with that name!</div>
<?php
	}
    
    elseif ($numrows2 > 0) {    
?>

		<form method="POST" action="">
		Title: <input type="text" name="title" size="50" maxlength="100"><br/>
		Author: <input type="text" name="author" size="50" maxlength="100"><br/>
		Book ID: <input type="text" name="bookid" size="5" maxlength="32"><br/><br/>
		<input type="submit" value="Add book"></form>
		<div id="errortext">There is already a book in the database with the book ID <?php echo $bookid;?>!</div>
<?php    
    }
    else{
		$user = stripslashes($user);
		$pass = stripslashes($pass);
		mysql_query("INSERT INTO `books` (title, author, bookid, bookavail) VALUES ('$title', '$author', '$bookid', 'Yes')");
?>
		You successfully added the book named "<?php echo stripslashes($title);?>" to the database! 
		<br/><a href="./addbooks.php">Add another book</a><br/>
<?php
  }
  }
  else{
?>
	<form method="POST" action="">
	Title: <input type="text" name="title" size="50" maxlength="100"><br/>
	Author: <input type="text" name="author" size="50" maxlength="100"><br/>
	Book ID: <input type="text" name="bookid" size="5" maxlength="32"><br/><br/>
	<input type="submit" value="Add book"></form>
    <div id="errortext">Book ID must be a number!</div>
<?php
  }
  }
  else {
?>
	<form method="POST" action="">
	Title: <input type="text" name="title" size="50" maxlength="100"><br/>
	Author: <input type="text" name="author" size="50" maxlength="100"><br/>
	Book ID: <input type="text" name="bookid" size="5" maxlength="32"><br/><br/>
	<input type="submit" value="Add book"></form>
    <div id="errortext">Please fill in the whole form!</div>
<?php  
  }
?>
<br/><br/><a href="./adminmain.php">Back to the Admin Control Panel</a><br/><a href="./adminbooks.php">View booklist / delete books</a>