Posts by MJorritsma

<?php
if(isset($_SESSION['id']) && isset($_SESSION['status']))
{
    if(isset($_GET['new']) && is_numeric($_GET['new']))
    {
        ?>
        <div class="content">
        <div class="csubject">Nieuwe bericht</div>
        <?php
        $pm_to        = mysqli_real_escape_string($mysqli, $_GET['new']);
        
        if($_SERVER['REQUEST_METHOD'] == 'POST')
        {
            $pm_subject = mysqli_real_escape_string($mysqli, $_POST['pm_subject']);
            $pm_message = mysqli_real_escape_string($mysqli, $_POST['pm_message']);
            
            $query = $mysqli->query("SELECT id FROM users WHERE id='" . $pm_to . "'");
            
            if(mysqli_num_rows($query) > 0)
            {
                $mysqli->query("INSERT INTO messages (pm_from, pm_to, pm_subject, pm_message, pm_unread, pm_date) VALUES ('" . $_SESSION['id'] . "','" . $pm_to . "','" . $pm_subject . "','" . $pm_message . "', 0, NOW())");
                
                if(mysqli_error($mysqli))
                {
                    echo '<div class="msg-err">' . mysqli_error($mysqli) . '</div>';
                }
                else
                {
                    echo '<div class="msg">Uw bericht is succesvol verzonden.</div>';
                }
            }
            else
            {
                echo '<div class="msg-err">U kan helaas geen bericht sturen naar een gebruiker die niet bestaat.</div>';
            }
        }
        
        $getuser = $mysqli->query("SELECT * FROM users WHERE id='" . $pm_to . "'");
        
        if(mysqli_num_rows($getuser) > 0)
        {
            $userrow = mysqli_fetch_assoc($getuser);
        }
        else
        {
            $userrow['username'] = 'Onbekend';
        }
        ?>
        <div style="padding: 5px;">
            <form method="post" action="">
            <fieldset>
              <legend>Naar</legend>
              <input type="text" name="pm_to" size="35" disabled="disabled" value="<?php echo htmlspecialchars($userrow['username']); ?>" />
            </fieldset>
            <fieldset>
              <legend>Onderwerp</legend>
              <input type="text" name="pm_subject" size="35" value="<?php echo isset($_SESSION['subject']) ? htmlspecialchars($_SESSION['subject']) : ''; ?>" />
            </fieldset>
            <fieldset>
              <legend>Bericht</legend>
              <textarea name="pm_message" cols="45" rows="10" style="width: 95%;" onload="this.select();"><?php echo isset($_SESSION['message']) ? "\n\r\n\r" . '---' . "\n\r" . htmlspecialchars($_SESSION['message']) : ''; ?></textarea>
            </fieldset>
            <fieldset>
                <input type="submit" value=" Verzend " />
            </fieldset>
            </form>
        </div>
        </div>    
        <?php
        unset($_SESSION['subject']);
        unset($_SESSION['message']);
    }
    elseif(isset($_GET['read']) && is_numeric($_GET['read']))
    {
        $pm_id = mysqli_real_escape_string($mysqli, $_GET['read']);
                
        if(isset($_GET['del']) && is_numeric($_GET['del']))
        {
            $mysqli->query("DELETE FROM messages WHERE pm_to='" . $_SESSION['id'] . "' AND pm_id='" . $pm_id . "'");
            
            echo 'Succesvol verwijdert, <a href="javascript:history.go(-2);">ga terug</a>. <script>javascript:history.go(-2);</script>';
        }
        else
        {
                $query = $mysqli->query("SELECT * FROM messages WHERE pm_to='" . $_SESSION['id'] . "' AND pm_id='" . $pm_id . "'");
                
                if(mysqli_num_rows($query) > 0)
                {
                    $row = mysqli_fetch_assoc($query);
                    
                    $getuser = $mysqli->query("SELECT * FROM users WHERE id='" . $row['pm_to'] . "'");
                    
                    if(mysqli_num_rows($getuser) > 0)
                    {
                        $userrow = mysqli_fetch_assoc($getuser);
                    }
                    else
                    {
                        $userrow['username'] = 'Onbekend';
                    }
                    ?>
                    <div class="content">
                    <div class="csubject"><?php echo htmlspecialchars($row['pm_subject']); ?></div>
                    <div style="padding: 5px;">
                    <?php echo htmlspecialchars(nl2br($row['pm_message'])); ?>
                    </div>
                    <div style="border-top: 1px dotted #CCC; padding: 5px; margin-top: 5px;">
                    <a href="javascript:history.go(-1);">Ga terug</a> | <a href="/content/inbox/new/<?php echo htmlspecialchars($row['pm_from']); ?>.html">Antwoorden</a> | <a href="/content/inbox/read/<?php echo $_GET['read']; ?>/delete/<?php echo $_GET['read']; ?>.html">Verwijderen</a>
                    </div>
                    </div>
                    <?php
                    $_SESSION['subject'] = $row['pm_subject'];
                    $_SESSION['message'] = $row['pm_message'];
                    
                    $mysqli->query("UPDATE messages SET pm_unread=1 WHERE pm_to='" . $_SESSION['id'] . "' AND pm_id='" . $pm_id . "'");
                }
                else
                {
                    echo '<div class="msg-err">Dit bericht is niet voor jouw bedoelt!</div>';
                }
        }
    }
    else
    {
        $count = $mysqli->query("SELECT pm_unread FROM messages WHERE pm_to='" . $_SESSION['id'] . "' AND pm_unread=0");
        $query = $mysqli->query("SELECT * FROM messages WHERE pm_to='" . $_SESSION['id'] . "' ORDER BY pm_date DESC");
        ?>
        <div class="content">
        <div class="csubject">Inbox<font color="#BBBBBB" size="1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<?php echo mysqli_num_rows($count); ?> nieuwe berichten</font></div>
        <div style="padding: 5px;">
        <?php
        if(mysqli_num_rows($query) > 0)
        {
            while($row = mysqli_fetch_assoc($query))
            {
                if($row['pm_unread'] == 0)
                {
                    $subject = '<b>' . $row['pm_subject'] . '</b>';
                }
                else
                {                
                    $subject = $row['pm_subject'];
                }
                
                $getuser = $mysqli->query("SELECT * FROM users WHERE id='" . $row['pm_to'] . "'");
                
                if(mysqli_num_rows($getuser) > 0)
                {
                    $userrow = mysqli_fetch_assoc($getuser);
                }
                else
                {
                    $userrow['username'] = 'Onbekend';
                }


                echo '<div class="message" onclick="window.location = \'/content/inbox/read/' . htmlspecialchars($row['pm_id']) . '.html\';">' . htmlspecialchars($subject) . ' <font color="#BBBBBB" size="1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Verzonden door ' . htmlspecialchars($userrow['username']) . ' op ' . htmlspecialchars($row['pm_date']) . '</font></div>';
            }
        }
        else
        {
            echo '<div class="topic">Er zijn helaas geen nieuwe berichten voor je.</div>';
        }
        ?>
        </div>
        </div>
        <?php
    }
}
else
{
    echo '<div class="content">
<div class="csubject">Niet ingelogd</span></div>
<div style="padding: 5px;">U dient ingelogd te zijn om deze pagina te bekijken. <a href=login.html alt=Inloggen title=Inloggen>Klik hier om in te loggen</a>.


</div>
</div>';
}
?>