$stmt = $db->prepare($sql);
        $stmt->bindValue(1, $NumLogins, PDO::PARAM_INT);
        $stmt->bindValue(2, $AdminID, PDO::PARAM_INT);
        try {
            $stmt->execute();
        } catch (PDOException $ex) {
            trigger_error($ex->getMessage(), E_USER_ERROR);
        }
        feedback("Login Successful!", "notice");
        if (isset($_SESSION['red']) && $_SESSION['red'] != "") {
            #check to see if we'll be redirecting to a requesting page
            $red = $_SESSION['red'];
            #redirect back to original page
            $_SESSION['red'] == '';
            #clear session var
            myRedirect($red);
        } else {
            myRedirect($config->adminDashboard);
            # successful login! Redirect to admin page
        }
    } else {
        # failed login, redirect
        feedback("Login and/or Password are incorrect.", "warning");
        myRedirect($config->adminLogin);
    }
    unset($result, $db);
    //clear resources
} else {
    feedback("Required data not sent. (error code #" . createErrorCode(THIS_PAGE, __LINE__) . ")", "error");
    myRedirect($config->adminLogin);
}
function updateExecute()
{
    if (!is_numeric($_POST['CustomerID'])) {
        //data must be alphanumeric only
        feedback("id passed was not a number. (error code #" . createErrorCode(THIS_PAGE, __LINE__) . ")", "error");
        myRedirect(THIS_PAGE);
    }
    $iConn = IDB::conn();
    //must have DB as variable to pass to mysqli_real_escape() via iformReq()
    $redirect = THIS_PAGE;
    //global var used for following formReq redirection on failure
    $CustomerID = iformReq('CustomerID', $iConn);
    //calls mysqli_real_escape() internally, to check form data
    $FirstName = strip_tags(iformReq('FirstName', $iConn));
    $LastName = strip_tags(iformReq('LastName', $iConn));
    $Email = strip_tags(iformReq('Email', $iConn));
    //next check for specific issues with data
    if (!ctype_graph($_POST['FirstName']) || !ctype_graph($_POST['LastName'])) {
        //data must be alphanumeric or punctuation only
        feedback("First and Last Name must contain letters, numbers or punctuation", "warning");
        myRedirect(THIS_PAGE);
    }
    if (!onlyEmail($_POST['Email'])) {
        //data must be alphanumeric or punctuation only
        feedback("Data entered for email is not valid", "warning");
        myRedirect(THIS_PAGE);
    }
    //build string for SQL insert with replacement vars, %s for string, %d for digits
    $sql = "UPDATE test_Customers set  \n    FirstName='%s',\n    LastName='%s',\n    Email='%s'\n     WHERE CustomerID=%d";
    # sprintf() allows us to filter (parameterize) form data
    $sql = sprintf($sql, $FirstName, $LastName, $Email, (int) $CustomerID);
    @mysqli_query($iConn, $sql) or die(trigger_error(mysqli_error($iConn), E_USER_ERROR));
    #feedback success or failure of update
    if (mysqli_affected_rows($iConn) > 0) {
        //success!  provide feedback, chance to change another!
        feedback("Data Updated Successfully!", "success");
    } else {
        //Problem!  Provide feedback!
        feedback("Data NOT changed!", "warning");
    }
    myRedirect(THIS_PAGE);
}
/**
 * handles POST data and formulates email response.
 * 
 * @param string $skipFields comma separated string of POST elements to be skipped
 * @param boolean $sendEmail indicates whether developer wants email sent or not
 * @param string $fromAddress fallback 'noreply' address for domain hosting page
 * @param string $toAddress address to receive email
 * @param string $website name of website where form was filled out
 * @param string $fromDomain name of website where form was filled out     
 * @return none 
 * @uses show_POST()
 * @todo none
 */
function handle_POST($skipFields, $sendEmail, $toName, $fromAddress, $toAddress, $website, $fromDomain)
{
    $aSkip = explode(",", $skipFields);
    #split form elements to skip into array
    $postData = show_POST($aSkip);
    #loops through and creates select POST data for display/email
    $fromAddress = "";
    //default
    if (is_email($_POST['Email'])) {
        #Only use Email for return address if valid
        $fromAddress = $_POST['Email'];
        # extra email injector paranoia courtesy of DH: http://wiki.dreamhost.com/PHP_mail()#Mail_Header_Injection
        $fromAddress = preg_replace("([\r\n])", "", $fromAddress);
    }
    if ($sendEmail) {
        #create email
        if (isset($_POST['Name'])) {
            $Name = $_POST['Name'];
        } else {
            $Name = "";
        }
        #Name, if used part of subject
        foreach ($_POST as $value) {
            #Content-Type: is too similar to email injection to allow
            $spaceless = str_replace(" ", "", $value);
            #in case hacker is clever enough to remove spaces
            if (stripos($spaceless, 'Content-Type:') !== FALSE) {
                feedback("Incorrect form data. Email NOT sent. (error code #" . createErrorCode(THIS_PAGE, __LINE__) . ")", "error");
                myRedirect(THIS_PAGE);
            }
        }
        $Name = safe($Name);
        #Name is part of Subject/header - filter code further for email injection
        if ($Name != "") {
            $SubjectName = " from: " . $Name . ",";
        } else {
            $SubjectName = "";
        }
        #Name, if used part of subject
        $postData = str_replace("<br />", PHP_EOL . PHP_EOL, $postData);
        #replace <br /> tags with double c/r
        $Subject = $website . " message" . $SubjectName . " " . date('F j, Y g:i a');
        $txt = $Subject . PHP_EOL . PHP_EOL . $postData;
        email_handler($toAddress, $toName, $Subject, $txt, $fromAddress, $Name, $website, $fromDomain);
    } else {
        //print data only
        print "Data printed only.  Email <b>not</b> sent!<br />";
        echo $postData;
        #Shows select POST data
        echo '<a href="' . THIS_PAGE . '">Reset Form</a><br />';
    }
}
function updateExecute($nav1 = '')
{
    $iConn = @mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME) or die(myerror(__FILE__, __LINE__, mysqli_connect_error()));
    $params = array('FirstName', 'LastName', 'AdminID', 'Email', 'Privilege');
    #required fields
    if (!required_params($params)) {
        //abort - required fields not sent
        feedback("Data not entered/updated. (error code #" . createErrorCode(THIS_PAGE, __LINE__) . ")", "error");
        header('Location:' . ADMIN_PATH . THIS_PAGE);
        die;
    }
    if (isset($_POST['AdminID']) && (int) $_POST['AdminID'] > 0) {
        $AdminID = (int) $_POST['AdminID'];
        #Convert to integer, will equate to zero if fails
    } else {
        feedback("AdminID not numeric", "warning");
        header('Location:' . ADMIN_PATH . THIS_PAGE);
        die;
    }
    $FirstName = dbIn($_POST['FirstName'], $iConn);
    $LastName = dbIn($_POST['LastName'], $iConn);
    $Email = strtolower(dbIn($_POST['Email'], $iConn));
    $Privilege = dbIn($_POST['Privilege'], $iConn);
    #check for duplicate email
    $sql = sprintf("select AdminID from " . PREFIX . "Admin WHERE (Email='%s') and AdminID != %d", $Email, $AdminID);
    $result = mysqli_query($iConn, $sql) or die(myerror(__FILE__, __LINE__, mysqli_error($iConn)));
    if (mysqli_num_rows($result) > 0) {
        # someone already has email!
        feedback("Email already exists - please choose a different email.");
        header('Location:' . ADMIN_PATH . THIS_PAGE);
        die;
    }
    #sprintf() function allows us to filter data by type while inserting DB values.  Illegal data is neutralized, ie: numerics become zero
    $sql = sprintf("UPDATE " . PREFIX . "Admin set FirstName='%s',LastName='%s',Email='%s',Privilege='%s' WHERE AdminID=%d", $FirstName, $LastName, $Email, $Privilege, $AdminID);
    @mysqli_query($iConn, $sql) or die(myerror(__FILE__, __LINE__, mysqli_error($iConn)));
    //feedback success or failure of insert
    if (mysqli_affected_rows($iConn) > 0) {
        feedback("Successfully Updated!", "notice");
        if ($_SESSION["AdminID"] == $AdminID) {
            #this is me!  update current session info:
            $_SESSION["Privilege"] = $Privilege;
            $_SESSION["FirstName"] = $FirstName;
        }
    } else {
        feedback("Data NOT Updated! (or not changed from original values)");
    }
    include INCLUDE_PATH . 'header.php';
    echo '
		<h1>Edit Administrator</h1>
		<p align="center"><a href="' . ADMIN_PATH . THIS_PAGE . '">Edit More</a></p>
		<p align="center"><a href="' . ADMIN_PATH . 'admin_dashboard.php">Exit To Admin</a></p>
		';
    include INCLUDE_PATH . 'footer.php';
}
     //data must be valid email
     feedback("Data entered for email is not valid", "error");
     header('Location:' . ADMIN_PATH . THIS_PAGE);
     die;
 }
 if (!onlyAlphaNum($_POST['PWord1'])) {
     //data must be alphanumeric or punctuation only
     feedback("Password must contain letters and numbers only.", "error");
     header('Location:' . ADMIN_PATH . THIS_PAGE);
     die;
 }
 $params = array('FirstName', 'LastName', 'PWord1', 'Email', 'Privilege');
 #required fields
 if (!required_params($params)) {
     //abort - required fields not sent
     feedback("Data not entered/updated. (error code #" . createErrorCode(THIS_PAGE, __LINE__) . ")", "error");
     header('Location:' . ADMIN_PATH . THIS_PAGE);
     die;
 }
 $iConn = @mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME) or die(myerror(__FILE__, __LINE__, mysqli_connect_error()));
 $FirstName = dbIn($_POST['FirstName'], $iConn);
 $LastName = dbIn($_POST['LastName'], $iConn);
 $AdminPW = dbIn($_POST['PWord1'], $iConn);
 $Email = strtolower(dbIn($_POST['Email'], $iConn));
 $Privilege = dbIn($_POST['Privilege'], $iConn);
 #sprintf() function allows us to filter data by type while inserting DB values.
 $sql = sprintf("INSERT into " . PREFIX . "Admin (FirstName,LastName,AdminPW,Email,Privilege,DateAdded) VALUES ('%s','%s',SHA('%s'),'%s','%s',NOW())", $FirstName, $LastName, $AdminPW, $Email, $Privilege);
 # insert is done here
 @mysqli_query($iConn, $sql) or die(myerror(__FILE__, __LINE__, mysqli_error($iConn)));
 # feedback success or failure of insert
 if (mysqli_affected_rows($iConn) > 0) {
/**
 * Prints a customized public error message
 *
 * Will use a custom error code created by calling 
 * createErrorCode() function, and display it to the user
 *  
 * @param string $myFile file name provided by PHP error handler
 * @param string $myLine line number of error provided by PHP error handler
 * @return void
 * @see createErrorCode()
 * @see printDeveloperError()  
 * @todo none
 */
function printUserError($myFile, $myLine)
{
    $errorCode = createErrorCode($myFile, $myLine);
    //Create error code out of file name & line number
    echo '<h2 align="center">Our page has encountered an error!</h2>';
    echo '<table align="center" width="50%" style="border:#F00 1px solid;"><tr><td align="center">';
    echo 'Please try again, or email support at <b>' . SUPPORT_EMAIL . '</b>,<br /> and let us know you are receiving ';
    echo 'the following Error Code: <b>' . $errorCode . '</b><br />';
    echo 'This will help us identify the problem, and fix it as quickly as possible.<br />';
    echo 'Thank you for your assistance and understanding!<br />';
    echo 'Sincerely,<br />Support Staff<br />';
    echo '<a href="index.php">Exit</a></td></tr></table>';
    get_footer();
    #add footer info!
    die;
    #one error is enough!
}
function updateExecute($nav1 = '')
{
    $params = array('AdminID', 'PWord1');
    #required fields
    if (!required_params($params)) {
        //abort - required fields not sent
        feedback("Data not entered/updated. (error code #" . createErrorCode(THIS_PAGE, __LINE__) . ")", "error");
        header('Location:' . ADMIN_PATH . THIS_PAGE);
        die;
    }
    if (isset($_POST['AdminID']) && (int) $_POST['AdminID'] > 0) {
        $AdminID = (int) $_POST['AdminID'];
        #Convert to integer, will equate to zero if fails
    } else {
        feedback("AdminID not numeric", "warning");
        header('Location:' . ADMIN_PATH . THIS_PAGE);
        die;
    }
    if (!onlyAlphaNum($_POST['PWord1'])) {
        //data must be alphanumeric or punctuation only
        feedback("Data entered for password must be alphanumeric only");
        header('Location:' . ADMIN_PATH . THIS_PAGE);
        die;
    }
    $iConn = @mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME) or die(myerror(__FILE__, __LINE__, mysqli_connect_error()));
    $AdminPW = dbIn($_POST['PWord1'], $iConn);
    # SHA() is the MySQL function that encrypts the password
    $sql = sprintf("UPDATE " . PREFIX . "Admin set AdminPW=SHA('%s') WHERE AdminID=%d", $AdminPW, $AdminID);
    @mysqli_query($iConn, $sql) or die(myerror(__FILE__, __LINE__, mysqli_error($iConn)));
    //feedback success or failure of insert
    if (mysqli_affected_rows($iConn) > 0) {
        feedback("Password Successfully Reset!", "notice");
    } else {
        feedback("Password NOT Reset! (or not changed from original value)");
    }
    @mysqli_close($iConn);
    include INCLUDE_PATH . 'header.php';
    echo '
	<p align="center"><h3>Reset Administrator Password</h3></p>
	<p align="center"><a href="' . ADMIN_PATH . THIS_PAGE . '">Reset More</a></p>
	<p align="center"><a href="' . ADMIN_PATH . 'admin_dashboard.php">Exit To Admin</a></p>
	';
    include INCLUDE_PATH . 'footer.php';
}