rendered paste body<?phpif (!defined('in_tt-admin')) { die ("Hacking Attempt!");}if (isset($_GET['chapid'])) { $result = $db->query("SELECT * FROM `".$config->database['prefix']."chapters` WHERE `id`=".mysql_real_escape_string(stripslashes($_GET['chapid']))); if (mysql_num_rows($result) == 1) { $chapter = mysql_fetch_assoc($result); if (isset($_POST['submit'])) { if (stripslashes(trim($_POST['name'])) != '' && stripslashes(trim($_POST['book'])) != '0' && stripslashes(trim($_POST['chapter'])) != '' && stripslashes(trim($_POST['contents'])) != '') { mysql_real_escape_string($_POST['data']); $db->query("UPDATE `".$config->database['prefix']."chapters` SET `title`='".mysql_real_escape_string(stripslashes($_POST['name']))."', `book`='".mysql_real_escape_string(stripslashes($_POST['book']))."', `chapter`='".mysql_real_escape_string(stripslashes($_POST['chapter']))."', `contents`='".mysql_real_escape_string(stripslashes($_POST['contents']))."' WHERE `id` = ".mysql_real_escape_string(stripslashes($_GET['chapid']))." LIMIT 1"); $db->log($_SESSION['tt-admin-username'], 'Edited Chapter: '.$_POST['name']." (".mysql_insert_id($link).")");?> <div class="page-block"> <div class="header"> <h2>Success!</h2> </div> <div class="contents"> The chapter was successfully edited! </div> </div><?php } else {?> <div class="error-block"> <div class="header"> <h2>An Error has Occured!</h2> </div> <div class="contents"> You cannot leave any fields in the form blank! </div> </div><?php } }?> <div class="page-block"> <div class="header"> <h2>Editing chapter: <?php print $chapter['title']; ?></h2> </div> <div class="contents"> <form action="<?php print $config->baseurl; ?>index.php?page=library&manage=chapters&do=edit&chapid=<?php print $chapter['id']; ?>" method="post"> <dl class="form"> <dt class="label"> <label for="name">Chapter Name</label> </dt> <dd class="input"> <input type="text" length="20" maxlength="255" name="name" id="name" class="input"<?php if (isset($_POST['name'])) { print " value=\"".htmlspecialchars(stripslashes($_POST['name']))."\""; } else { print ' value="'.htmlspecialchars(stripslashes($chapter['title'])).'"'; } ?> /> </dd> </dl> <dl class="form"> <dt class="label"> <label for="book">Book</label> </dt> <dd class="input"> <select name="book" id="book" class="select"> <option selected="selected" value="0">Please Select</option> <?php $bookresult = $db->query("SELECT * FROM `".$config->database['prefix']."books`"); //if (mysql_num_rows($bookresult) != 0) { $book = mysql_fetch_array($bookresult); ?> <option value="<?php print $book['id']; ?>"><?php print $book['title']; ?></option> <?php //}?> </select> </dd> </dl> <dl class="form"> <dt class="label"> <label for="chapter">Chapter #</label> </dt> <dd class="input"> <input type="text" length="4" maxlength="3" name="chapter" id="chapter" class="input"<?php if (isset($_POST['chapter'])) { print " value=\"".htmlspecialchars(stripslashes($_POST['chapter']))."\""; } else { print ' value="'.htmlspecialchars(stripslashes($chapter['chapter'])).'"'; } ?> /> </dd> </dl><?php if (isset($_POST['contents'])) {?> <textarea name="contents" id="contents" rows="10" cols="50" class="textarea"><?php print htmlspecialchars(stripslashes($_POST['contents'])); ?></textarea><?php } else {?> <textarea name="contents" id="contents" rows="10" cols="50" class="textarea"><?php print htmlspecialchars(stripslashes($chapter['contents'])); ?></textarea><?php }?> <div class="center"> <input type="hidden" value="<?php print $chapter['id']; ?>" name="id" id="id" /> <input type="submit" value="Edit Chapter" name="submit" id="submit" class="input" /> </div> </form> </div> </div><?php } else {?> <div class="error-block"> <div class="header"> <h2>An Error has Occured!</h2> </div> <div class="contents"> The specified chapter id does not exist. </div> </div><?php }} else {?> <div class="error-block"> <div class="header"> <h2>An Error has Occured!</h2> </div> <div class="contents"> You dolt! Please specify the chapter id that you want to edit! </div> </div><?php}?>