<?php


/*


Anti-MySQL code + hij mailt het ip adres ook door!


*/


$locatie = $_SERVER['REQUEST_URI'];
$array = Array();
$array[] = "mysql";
$array[] = ")";
$array[] = ";";
$array[] = "}";
$array[] = "INSERT";
$array[] = "DROPTABLE";
$array[] = "TRUNCATE";
$array[] = "DROP";
$array[] = "UPDATE";
$array[] = "COOKIE";
$array[] = "ENV";
$array[] = "FILES";
$array[] = "GET";
$array[] = "POST";
$array[] = "REQUEST";
$array[] = "SERVER";
foreach($array As $foutbezig) {
echo "Internet fout, ip adres doorgegeven aan domein houder.";
mail("mailadres hier l","Mysql Injection","Mysql Injection
IP-Adres: $_SERVER[REMOTE_ADDR]","From: $sitename <$noreply>");
exit();


 
}


?>

<?php
include('header.php');


if(!$is_online){
	redirect('index.php');
	exit;
}


$tw1 = $db->Query("SELECT * FROM `twitter` WHERE `user`='".$data['id']."' AND `active`='0'");
$tw = $db->FetchArray($tw1);


if(isset($_POST['submit']) && $_POST['name'] != "") {
$name = $db->EscapeString($_POST['name']);


$sql = $db->Query("SELECT id FROM `twitter` WHERE `t_name`='".$name."' AND `user`='".$data['id']."'");
$ext = $db->GetNumRows($sql);
if($ext > 0){
	$db->Query("UPDATE `twitter` SET `active`='0' WHERE `t_name`='".$name."' AND `user`='".$data['id']."'");
	$mesaj = '<div class="success">Twitter successfully added!</div>';
	$h = 1;
}else{
	$sql = $db->Query("SELECT id FROM `twitter` WHERE `t_name`='".$name."'");
	$num = $db->GetNumRows($sql);


	if($num > 0){
		$mesaj = '<div class="msg"><div class="error">Twitter already exist!</div></div>';
	}else{
		$url = get_data("http://api.twitter.com/1/users/lookup.json?screen_name=".$name);
		$xml = json_decode($url, true);
		$id = $xml[0]['id'];
		$av = $xml[0]['profile_image_url'];
	if ($id != "")
	{
		$db->Query("INSERT INTO `twitter` (user, t_name, t_id, t_av) VALUES('".$data['id']."', '".$name."', '".$id."', '".$av."')");
		$mesaj = '<div class="msg"><div class="success">Twitter successfully added!</div></div>';
		$h = 1;
	}elseif($xml['error'] != ''){
		$mesaj = '<div class="msg"><div class="error"><b>Twitter says:</b> '.$xml['error'].'</div></div>';
	}else{
		$mesaj = '<div class="msg"><div class="error">Twitter doesn\'t exist!</div></div>';
	}}
}}


if($_GET['a'] == "del"){
		$cpc = $db->EscapeString($_POST['cpc']);


		$db->Query("UPDATE `users` SET `coins`=`coins`+'".$tw['points']."' WHERE `id`='".$data['id']."'");
		$db->Query("DELETE FROM `twitter` WHERE `user`='".$data['id']."'");
		$db->Query("DELETE FROM `followed` WHERE `site_id`='".$tw['id']."'");
		redirect("twitterconfig.php");
}?>
<div class="block medium right">
			<div class="top">		
					<h1>Twitter Account</h1>
			</div>
		<div class="content"><? echo $mesaj; ?> 
<? 
if($_GET['a'] == "cpc"){
	if(isset($_POST['editcpc']) && $_POST['cpc'] > 0 && $_POST['cpc'] <= 5){
		$cpc = $db->EscapeString($_POST['cpc']);
		$db->Query("UPDATE `twitter` SET `cpc`='".$cpc."' WHERE `t_name`='".$tw['t_name']."' AND `user`='".$data['id']."'");
		echo '<div class="msg"><div class="success">CPC successfully changed!</div></div>';
	}
?>
<form method="post">
<fieldset>
	<p>
		<label>CPC*</label> <br/>
        <select class="styled" name="cpc">
		    <option value="1">1 Coin</option>
			<option value="2"<?=($tw['cpc'] == 2 ? ' selected' : '')?>>2 Coins</option>
			<option value="3"<?=($tw['cpc'] == 3 ? ' selected' : '')?>>3 Coins</option>
			<option value="4"<?=($tw['cpc'] == 4 ? ' selected' : '')?>>4 Coins</option>
			<option value="5"<?=($tw['cpc'] == 5 ? ' selected' : '')?>>5 Coins</option><?if($data['premium'] > 0){?>
			<option value="6"<?=($tw['cpc'] == 6 ? ' selected' : '')?>>6 Coins</option>
			<option value="7"<?=($tw['cpc'] == 7 ? ' selected' : '')?>>7 Coins</option>
			<option value="8"<?=($tw['cpc'] == 8 ? ' selected' : '')?>>8 Coins</option>
			<option value="9"<?=($tw['cpc'] == 9 ? ' selected' : '')?>>9 Coins</option>
			<option value="10"<?=($tw['cpc'] == 10 ? ' selected' : '')?>>10 Coins</option><?}?>
		</select>
	</p>
	<p><small><b>* Coins per Click.</b></small></p>	
    <p>
		<input type="submit" class="button gray small" value="Change CPC" name="editcpc" />
	</p>
</fieldset>
</form>
<? }elseif($tw['t_name'] != ""){?>
<div style="float:left; margin-left: 5px;"><img src="<?=$tw['t_av']?>" border="0" /></div>
<div style="float:left; margin-left: 5px;"><b><a href="http://twitter.com/<?=$tw['t_name']?>" style="text-decoration: underline; color: #000;" target="_blank"><?=$tw['t_name']?></a></b> (<a href="twitterconfig.php?a=del" style="text-decoration: none; color: red;">Delete</a>)<br><b>Coins:</b> <?=$tw['points']?> (<a href="addcoins.php?x=twitter" style="text-decoration: none; color: blue;">Add</a>)<br><b>CPC:</b> <?=$tw['cpc']?> (<a href="twitterconfig.php?a=cpc" style="text-decoration: none; color: blue;">Edit</a>)</div>
<?}elseif(isset($_POST['submit']) && $h == 1){?>
<center><br><img src="<?=$av?>" border="0" /><br><b><?=$_POST['name']?></b></center><?}else{?>
<form method="post">
<table class="form">
	<tr>
		<td width="150px"><b>Twitter Username</b></td>
		<td>
			<input type="text" name="name" /><br />			
		</td>
	</tr>
	<tr>
		<td></td>
		<td><input type="submit" name="submit" value="Submit" /></td>
	</tr>
</table>
<div class="msg"><div class="info">If you don't add your real twitter username, used on exchange, you can't earn coins.</div></div>
</form>
<?}?>
				</div>
			</div>		
<?include('footer.php');?>