<div class="tableborder">
<div class='maintitle' align='left'><span class="maintitle style7"><img src='images/nav_m.gif' width='8' height='8' border='0' /> Messages </span></div>
<table width="100%" border="0" cellspacing="1" cellpadding="4">
<tr>
<th align="center" width="6%" class='titlemedium'><img src="http://70.84.190.115/style_images/1/spacer.gif" width="28" height="1" /></th>
<th align="left" class='titlemedium'> </th>
</tr>
<tr>
<td class="row4" align="center"><img src='images/marker.gif' width="35" height="35" border='0' /></td>
<td class="row4">
<?
ob_start();
//the above line needs to be above ALL HTML and PHP (except for <?).
include("config.php");
//gets the config page, which connects to the database and gets the user's information
if ($logged[username])
{
//checks to see if they are logged in
switch($_GET[page])
{
//this allows us to use one page for the entire thing
default:
echo ("- <a href=\"?act=messages.php&page=inbox\">Inbox</a><br />
- <a href=\"?act=messages.php&page=write\">New Message</a><br />
- <a href=\"?act=messages.php&page=outbox\">Outbox</a>");
if($logged[username] && $logged[level] == 5)
echo ("<br />- <a href=\"?act=messages.php&page=sticky\">New Sticky Message</a>");
if($logged[username] && $logged[level] == 3)
echo ("<br />- <a href=\"?act=messages.php&page=sticky\">New Sticky Message</a>");
break;
case 'write':
if (!$_POST[send])
{
//the form hasnt been submitted yet....
echo ("<form method=\"POST\" style=\"margin: 0px;\">
<dl style=\"margin: 0px;\">
<dt>recipient</dt>
<dd>
<select name=\"to\">
");
$getusers = mysql_query("SELECT * FROM users ORDER BY 'username' ASC");
while ($users = MySQL_Fetch_Array($getusers)) {
echo ("<option value=\"$users[username]\">$users[username]</option>");
}
//the above line gets all the members names and puts them in a drop down box
echo ("
</select>
</dd>
<dt>Message Subject</dt>
<dd><input type=\"text\" name=\"subject\" size=\"20\"></dd>
<dt>Message</dt>
<dd><textarea rows=\"7\" name=\"message\" cols=\"35\"></textarea>
</dd><dt> </dt>
<dd><input type=\"submit\" value=\"Submit\" name=\"send\"></dd>
</dl>
</form>
");
}
if ($_POST[to])
{
//the form has been submitted. Now we have to make it secure and insert it into the database
$subject = htmlspecialchars(addslashes("$_POST[subject]"));
$message = htmlspecialchars(addslashes("$_POST[message]"));
$to = htmlspecialchars(addslashes("$_POST[to]"));
//the above lines remove html and add \ before all "
$send = mysql_query("INSERT INTO `pmessages` ( `title` , `message` ,
`touser` , `from` , `unread` ,
`date` ) VALUES ('$subject', '$message', '$to',
'$logged[username]', 'unread', NOW())");
echo ("Your message has been sent.");
}
break;
case 'sticky':
if (!$_POST[send])
{
//the form hasnt been submitted yet....
echo ("<form method=\"POST\" style=\"margin: 0px;\">
<dl style=\"margin: 0px;\">
<dt>recipient</dt>
<dd>
<select name=\"to\">
");
$getusers = mysql_query("SELECT * FROM members ORDER BY 'username' ASC");
while ($users = MySQL_Fetch_Array($getusers)) {
echo ("<option value=\"$users[username]\" ");
if($users[username] == $_GET['user'])
{
echo("selected= \"selected\" ");
}
echo(">$users[username]</option>");
} //the above line gets all the members names and puts them in a drop down box
echo ("
</select>
</dd>
<dt>Message Subject</dt>
<dd><input type=\"text\" name=\"subject\" size=\"20\"></dd>
<dt>Message</dt>
<dd><textarea rows=\"7\" name=\"message\" cols=\"35\"></textarea>
</dd><dt> </dt>
<dd><input type=\"submit\" value=\"Submit\" name=\"send\"></dd>
</dl>
</form>
");
}
if ($_POST[to])
{
//the form has been submitted. Now we have to make it secure and insert it into the database
$subject = htmlspecialchars(addslashes("$_POST[subject]"));
$message = htmlspecialchars(addslashes("$_POST[message]"));
$to = htmlspecialchars(addslashes("$_POST[to]"));
//the above lines remove html and add \ before all "
$send = mysql_query("INSERT INTO `pmessages` ( `title` , `message` ,
`touser` , `from` , `unread` ,
`date` , `sticky` ) VALUES ('$subject', '$message', '$to',
'$logged[username]', 'unread', NOW(), 1)");
echo ("Your message has been sent.");
}
break;
case 'delete':
if (!$_GET[msgid])
{
echo ("Sorry, but this is an invalid message!");
}
else
{
$getmsg = mysql_query("SELECT * from pmessages where id = '$_GET[msgid]'");
$msg = mysql_fetch_array($getmsg);
//hmm..someones trying to delete someone elses messages! This keeps them from doing it
if ($msg[touser] != $logged[username])
{
echo ("This message was not sent to you!");
}
elseif ($msg[sticky] != '1')
{
$delete = mysql_query("delete from pmessages where id = '$_GET[msgid]'");
echo "Your message has been deleted.";
}
else
{
echo "This Message Cannot Be Deleted.";
}
}
break;
case 'inbox':
$get = mysql_query("SELECT * from pmessages where touser = '$logged[username]' order by id desc");
echo("
<table bgcolor=\"#dddddd\" border=\"0\" width=\"100%\" cellspacing=\"0\">
<tr>
<td align=\"center\">Subject</td>
<td align=\"center\" width=\"125\">From</td>
<td align=\"center\" width=\"97\">Date</td>
<td width=\"25\">Delete</td>
</tr>
</table>
");
$nummessages = mysql_num_rows($get);
if ($nummessages == 0)
{
echo ("You have 0 messages!");
}
else
{
echo("<table border=\"0\" width=\"100%\" cellspacing=\"1\">");
while ($messages = mysql_fetch_array($get))
{
//the above lines gets all the messages sent to you, and displays them with the newest ones on top
echo ("
<tr>
<td><a href=\"?act=messages.php&page=view&msgid=$messages[id]\">");
if ($messages[reply] == yes)
{
echo ("Reply to: ");
}
echo "<form method='post'>";
echo "$messages[title]</a></td>
<td width=\"125\">$messages[from]</td>
<td width=\"97\">$messages[date]</td>
<td width=\"25\"><input type='checkbox' name='messages[]' value='$messages[id]'></td>
</tr>";
}
echo "<tr>
<td colspan='4'><div align='right'><input type='submit' name='delete_pms' value='Delete Selected'></div>
<div align='right'><input type='submit' name='delete_all' value='Delete All'></div></td>
</tr>";
echo ("</form></table>");
}
}
}
break;
case 'view':
//the url now should look like ?page=view&msgid=#
if (!$_GET[msgid])
{
//there isnt a &msgid=# in the url
echo ("Invalid message!");
}
else
{
//the url is fine..so we continue...
$getmsg= mysql_query("SELECT * from pmessages where id = '$_GET[msgid]'");
$msg = mysql_fetch_array($getmsg);
//the above lines get the message, and put the details into an array.
if ($msg[touser] == $logged[username])
{
//makes sure that this message was sent to the logged in member
if (!$_POST[message])
{
//the form has not been submitted, so we display the message and the form
$markread = mysql_query("Update pmessages set unread = 'read' where id = '$_GET[msgid]'");
//this line marks the message as read.
$msg[message] = nl2br(stripslashes("$msg[message]"));
//removes slashes and converts new lines into line breaks.
echo ("
<form method=\"POST\" style=\"margin: 0px;\">
<dl style=\"margin: 0px;\">
<dt><b>$msg[title] -- From <a href=\"?act=members.php&user=$messages[fromuser]\">
$messages[fromuser]</a></b></dt>
<dd>$msg[message]</dd>
<dt><b>Reply</b></dt>
<dd><textarea rows=\"6\" name=\"message\" cols=\"45\"></textarea></dd>
<dt> </dt>
<dd><input type=\"submit\" value=\"Submit\" name=\"send\"></dd>
</dl></form>");
}
if ($_POST[message])
{
//the form HAS been submitted, now we insert it into the database
$message = htmlspecialchars(addslashes("$_POST[message]"));
$do = mysql_query("INSERT INTO `pmessages` ( `title` , `message` , `touser` , `fromuser` , `unread` ,
`date`, `reply`) VALUES
('$msg[title]', '$message', '$msg[from]', '$logged[username]',
'unread', NOW(), 'yes')");
$newpmemail = mysql_query("SELECT * FROM users WHERE username= '$_POST[to]'");
echo ("Your message has been sent");
}
}
$getmsg= mysql_query("SELECT * from pmessages where id = '$_GET[msgid]'");
$msg = mysql_fetch_array($getmsg);
//the above lines get the message, and put the details into an array.
if ($msg[fromuser] == $logged[username])
{
//makes sure that this message was sent to the logged in member
if (!$_POST[message])
{
//the form has not been submitted, so we display the message and the form
//this line marks the message as read.
$msg[message] = nl2br(stripslashes("$msg[message]"));
//removes slashes and converts new lines into line breaks.
}
}
else
{
//hmm..this message was NOT sent to the logged in user...so we won't display it.
echo("<b>Error</b><br />");
echo ("This message was sent incorrectly to you. It might be because the sender missed out capitals in your name. please send a message back to the sender saying you can't veiw the message because they spelt your name wrong.");
}
}
break;
case 'outbox':
$get = mysql_query("SELECT * from pmessages where fromuser = '$logged[username]' order by id desc"); // gets the messages that you sent
echo("
<table bgcolor=\"#dddddd\" border=\"0\" width=\"100%\" cellspacing=\"0\">
<tr>
<td align=\"center\">Subject</td>
<td align=\"center\" width=\"125\">To</td>
<td align=\"center\" width=\"97\">Date</td>
<td width=\"25\">Read/Unread</td>
</tr>
</table>
");
$nummessages = mysql_num_rows($get);
if ($nummessages == 0)
{
echo ("You have sent 0 messages!");
}
else
{
echo("<table border=\"0\" width=\"100%\" cellspacing=\"1\">");
while ($messages = mysql_fetch_array($get))
{
//the above lines gets all the messages sent to you, and displays them with the newest ones on top
echo ("
<tr>
<td><a href=\"?act=messages.php&page=view&msgid=$messages[id]\">");
if ($messages[reply] == yes)
{
echo ("Reply to: ");
}
echo ("$messages[title]</a></td>
<td width=\"125\">$messages[touser]</td>
<td width=\"97\">$messages[date]</td>
<td width=\"25\">$messages[unread]</td>
</tr>");
}
echo ("</table>");
}
break;
case 'multidelete':
if(isset($_POST['delete_pms'])) {
$delete_array = $_POST['messages'];
//loop through each individual item in the array
foreach($delete_array as $val) {
$query = mysql_query("DELETE FROM pmessages WHERE id = '$val'");
}
echo ("PM(s) deleted!");
echo ("You Will Be Redirected... <br>
<meta http-equiv=\"refresh\" content=\"3;URL=http://techtuts.com/?view=cpanel&mode=messenger&page=inbox\">");
}
else
{
if(isset($_POST['delete_all'])) {
$query = mysql_query("DELETE FROM pmessages WHERE touser = '$logged[username]'");
echo ("Your Inbox Is Now Empty!)";
echo ("You Will Be Redirected.. <br>
<meta http-equiv=\"refresh\" content=\"3;URL=?act=messages.php&view=inbox\">");
}
}
break;
}
echo("<br /><br /><div align=\"center\"><b><a href=\"?act=messages.php&page=inbox\">Inbox</a> · <a href=\"?act=messages.php&page=write\">New Message</a> · <a href=\"?act=messages.php&page=outbox\">Outbox</a></b>");
if($logged[username] && $logged[level] == 5)
echo ("<b> · <a href=\"?act=messages.php&page=sticky\">New Sticky Message</a></b>");
if($logged[username] && $logged[level] == 3)
echo ("<b> · <a href=\"?act=messages.php&page=sticky\">New Sticky Message</a></b>");
}
else
{
echo("You are not loged in. Please login to veiw the message system.");
}
?>
</td>
</tr>
<tr>
<td class='darkrow2' colspan="2"> </td>
</tr>
</table>
</div>