function strip_forum_tags($text)
{
$text = str_replace("\r\n", "[br]", $text);
$text = String::secure_user_input($text);
$text = preg_replace("/\\[B\\]/i", "<b>", $text);
$text = preg_replace("/\\[\\/B\\]/i", "</b>", $text);
$text = preg_replace("/\\[I\\]/i", "<i>", $text);
$text = preg_replace("/\\[\\/I\\]/i", "</i>", $text);
$text = preg_replace("/\\[U\\]/i", "<u>", $text);
$text = preg_replace("/\\[\\/U\\]/i", "</u>", $text);
$text = preg_replace("/\\[QUOTE\\]/i", "<div class=forum_quote>", $text);
$text = preg_replace("/\\[\\/QUOTE\\]/i", "</div>", $text);
$text = str_replace('[br]', "<br>", $text);
$text = preg_replace("/\\[URL=([^\\]]*)\\]([^\\[]*)\\[\\/URL\\]/i", "<a href=\\1>\\2</a>", $text);
$text = preg_replace("/\\[IMG\\]([^\\[]*)\\[\\/IMG\\]/i", "<img src=\\1>", $text);
return $text;
}
$cur_site = String::unformat_array($cur_site);
$cur_site2 = $db->get_single("SELECT kurs,znak FROM fw_currency WHERE id=" . CURRENCY_SITE2);
$cur_site2 = String::unformat_array($cur_site2);
$cur_admin = $db->get_single("SELECT kurs,znak FROM fw_currency WHERE id=" . CURRENCY_ADMIN);
$cur_admin = String::unformat_array($cur_admin);
$smarty->assign("currency_site", $cur_site);
$smarty->assign("currency_site2", $cur_site2);
/*
$file=fopen(BASE_PATH.'/test1.txt','w');
fwrite($file,$_SERVER['REQUEST_URI']);
fclose($file);
*/
/*-----------------РАЗЛИЧНЫЕ ДЕЙСТВИЯ-----------------*/
if (isset($_POST['submit_rating'])) {
$id = $_POST['id'];
$comment = String::secure_user_input($_POST['nm_text']);
$comment = Common::strip_forum_tags($comment);
$author = $_SESSION['fw_user']['id'];
if ($comment != '') {
$db->query("INSERT INTO fw_products_comments(product_id,author,text,insert_date) VALUES('{$id}','{$author}','{$comment}','" . time() . "')");
}
if (isset($_POST['rating'])) {
$rating = $_POST['rating'];
$check_rating = explode(",", $_COOKIE['fw_rating']);
if (!in_array($id, $check_rating)) {
$db->query("UPDATE fw_products SET rating=rating+{$rating} WHERE id='{$id}'");
if (!@isset($_COOKIE['fw_rating']) or $_COOKIE['fw_rating'] == '') {
$cookie_content = $id;
} else {
$cookie_content = $_COOKIE['fw_rating'] . ',' . $id;
}
<?php
$css[] = BASE_URL . '/modules/guestbook/front/templates/guestbook.css';
require_once 'lib/class.mail.php';
$navigation[] = array("url" => $module_url, "title" => $node_content['name']);
$this_module = $db->get_single("SELECT priv FROM fw_modules WHERE name='guestbook' LIMIT 1");
if (isset($_SESSION['fw_user']) && $_SESSION['fw_user']['priv'] <= $this_module['priv']) {
$smarty->assign("show_admin_menu", "true");
$is_admin = true;
} else {
$is_admin = false;
}
if (isset($_POST['submit_new_message'])) {
$check = true;
$author = String::secure_user_input($_POST['nm_name']);
if (!preg_match("/^[a-z0-9_\\.-]*@[a-z0-9_\\.-]*\\.[a-z]{0,3}\$/i", $_POST['nm_mail']) && $_POST['nm_mail'] != '') {
$check = false;
$smarty->assign("error_message", "Введённый e-mail имеет неправильный формат");
} else {
$mail = $_POST['nm_mail'];
}
$text = Common::strip_forum_tags($_POST['nm_text']);
if ($check) {
if (GB_PREMODERATION == 'on') {
$status = '0';
} else {
$status = '1';
}
$db->query("INSERT INTO fw_guestbook(author,message,insert_date,author_mail,status) VALUES('{$author}','{$text}','" . time() . "','{$mail}','{$status}')");
$body = $smarty->fetch(BASE_PATH . '/modules/guestbook/admin_mail_template.txt');
$headers = "Content-type: text/html; charset=windows-1251 \r\n";
/*-----------------РАЗЛИЧНЫЕ ДЕЙСТВИЯ-----------------*/
if (isset($_REQUEST['filterhash'])) {
$return = array('status' => 'success', 'data' => null);
if (!empty($_POST)) {
$dataJson = json_encode($_POST);
$hash = sha1($dataJson . microtime(true));
$db->query("replace into filter_hashes (`hash`, `data`) values('{$hash}', '{$dataJson}')");
$return = array('status' => 'success', 'data' => $hash);
}
header('Content-Type:text/json;charset:utf8;');
echo json_encode($return, true);
die;
}
if (isset($_POST['submit_comment'])) {
$id = $_POST['brand_id'];
$comment = String::secure_user_input($_POST['ntrcn']);
$comment = Common::strip_forum_tags($comment);
//$author=$_SESSION['fw_user']['id'];
$username = strip_tags($_POST['bvz']);
$email = strip_tags($_POST['tvfbk']);
if (trim($_POST['username']) == '') {
if (trim($_POST['email']) == '') {
if (trim($_POST['text']) == '') {
if ($comment != '') {
$db->query("INSERT INTO fw_products_comments(product_id,username, email,text,insert_date) VALUES('{$id}','{$username}', '{$email}','{$comment}','" . time() . "')");
}
}
}
}
$location = @$_SERVER['HTTP_REFERER'];
header("Location: {$location}");
}
$smarty->assign("message", "Сообщение отправлено");
}
}
if (count($url) == 4 && $url[$n - 2] == 'messages' && $url[$n - 1] == 'delete') {
$page_found = true;
$id = $url[$n];
$db->query("DELETE FROM fw_messages WHERE id='{$id}' AND (`to`='" . $_SESSION['fw_user']['id'] . "' OR `from`='" . $_SESSION['fw_user']['id'] . "')");
$location = $_SERVER['HTTP_REFERER'];
header("Location: {$location}");
}
if (isset($_POST['submit_edit_albums'])) {
$sort_order = $_POST['sort_order'];
foreach ($sort_order as $k => $v) {
if (preg_match("/^[0-9]*\$/", String::secure_user_input($v))) {
$db->query("UPDATE fw_user_albums SET sort_order='" . String::secure_user_input($v) . "' WHERE id='" . String::secure_user_input($k) . "'");
}
}
$location = $_SERVER['HTTP_REFERER'];
header("Location: {$location}");
}
/*--------------------ОТОБРАЖЕНИЕ---------------------*/
switch (TRUE) {
case $url[$n] == 'login' && count($url) == 2:
$navigation[] = array("url" => 'register', "title" => 'Войти');
$page_found = true;
$template = 'cabinet_login.html';
break;
case $url[$n] == 'register' && count($url) == 2:
$navigation[] = array("url" => 'register', "title" => 'Стать своим');
$smarty->assign("mode", "register");
<?php
session_start();
require_once 'conf/globals.php';
require_once 'lib/class.db.php';
require_once 'lib/class.common.php';
require_once 'lib/class.string.php';
/* ------------ ÏÎÄÊËÞ×ÀÅÌÑß Ê ÁÀÇÅ ÄÀÍÍÛÕ -------------- */
$db = new db(DB_NAME, DB_HOST, DB_USER, DB_PASS);
if (isset($_GET['target'])) {
$id = String::secure_user_input($_GET['target']);
$banner = $db->get_single("SELECT * FROM fw_banners WHERE id='{$id}'");
if (isset($banner['id'])) {
$db->query("UPDATE fw_banners SET clicks=clicks+1 WHERE id='{$id}'");
$location = $banner['target_url'];
header("Location: {$location}");
} else {
$location = $_SERVER['HTTP_REFERER'];
header("Location: {$location}");
}
}
<?php
require_once BASE_PATH . '/lib/class.mail.php';
if ($switch_default == 'on' && $main_module != 'on') {
}
if ($main_module == 'on') {
$navigation[] = array("url" => $module_url, "title" => $node_content['name']);
switch (TRUE) {
case count($url) == 1:
$page_found = true;
if (isset($_POST['submit_new_subscribe'])) {
$mail = String::secure_user_input($_POST['new_subscriber_mail']);
$action = $_POST['new_subscriber_action'];
$check = true;
$time = time();
if ($action == 'subscribe') {
if (CONFIRM_SUBSCRIPTION == 'yes') {
$status = '0';
} else {
$status = '1';
}
$check_subscriber = $db->get_single("SELECT mail FROM fw_subscribe_list WHERE mail='{$mail}'");
if ($check_subscriber['mail'] != '') {
$check = false;
$smarty->assign("error_message", "Извините, этот адрес уже есть в нашей базе.");
}
if ($check) {
$db->query("INSERT INTO fw_subscribe_list(mail,reg_date,status) VALUES('{$mail}','{$time}','{$status}')");
}
if (CONFIRM_SUBSCRIPTION == 'yes') {
$smarty->assign("site_url", BASE_URL);
}
if (isset($_POST['edit_form_element_name'])) {
foreach ($_POST['edit_form_element_name'] as $k => $v) {
$upd = array();
$upd[] = "name='" . String::secure_user_input($_POST['edit_form_element_name'][$k]) . "'";
$upd[] = "type='" . intval($_POST['edit_form_element_type'][$k]) . "'";
if ($_POST['edit_form_element_type'][$k] == "3") {
$upd[] = "value='" . String::secure_user_input($_POST['edit_form_element_value'][$k]) . "'";
}
$upd[] = "sort_order='" . intval($_POST['edit_form_element_sort_order'][$k]) . "'";
$upd[] = "status='" . (isset($_POST['edit_form_element_status'][$k]) ? "1" : "0") . "'";
$db->query("UPDATE fw_forms_elements SET " . implode(", ", $upd) . " WHERE id='{$k}'");
}
}
$name = String::secure_user_input($_POST['edit_forms_name']);
$email = String::secure_user_input($_POST['edit_forms_email']);
$status = intval($_POST['edit_forms_status']);
if ($check) {
$db->query("UPDATE fw_forms SET name='{$name}',email='{$email}',status='{$status}' WHERE id='{$id}'");
$location = $_SERVER['HTTP_REFERER'];
header("Location: {$location}");
}
}
/*--------------------------------- ќ“ќЅ–ј∆≈Ќ»≈ ------------------------------*/
switch (TRUE) {
case $action == 'add':
$navigation[] = array("url" => BASE_URL . "/admin/?mod=forms&action=add", "title" => 'ƒобавить форму');
$smarty->assign("mode", "add");
$template = 'forms.a_edit.html';
break;
case $action == 'edit' && isset($_GET['id']):
$location = 'index.php?mod=banners&action=edit_banner&id=' . $id;
header("Location: {$location}");
}
}
if (isset($_POST['submit_add_group'])) {
Common::check_priv("{$priv}");
$name = String::secure_user_input($_POST['name']);
$db->query("INSERT INTO fw_banners_groups(name) VALUES('{$name}')");
$location = 'index.php?mod=banners&action=groups_list';
header("Location: {$location}");
die;
}
if (isset($_POST['submit_edit_group'])) {
Common::check_priv("{$priv}");
$name = String::secure_user_input($_POST['name']);
$id = String::secure_user_input($_POST['id']);
$db->query("UPDATE fw_banners_groups SET name='{$name}' WHERE id='{$id}'");
$location = $_SERVER['HTTP_REFERER'];
header("Location: {$location}");
die;
}
/*--------------------------------- ќ“ќЅ–ј∆≈Ќ»≈ ------------------------------*/
switch (TRUE) {
case $action == 'groups_list':
$navigation[] = array("url" => BASE_URL . "/admin/?mod=banners&action=groups_list", "title" => '√руппы баннеров');
if (isset($_GET['page'])) {
$page = $_GET['page'];
} else {
$page = 1;
}
$result = $db->query("SELECT COUNT(*) FROM fw_banners_groups");