ill post them here.
forum-index.php
<?php
session_start();
include'global.php';
$action = $_GET['act'];
$actions_array = array('forum','create','topic','reply');
?>
<html>
<head>
<title>Nostrich's Forum</title>
<link rel="stylesheet" href="style3.css" type="text/css" />
</head>
<body>
<center>
<div id="holder">
<div id="userInfo">
<?php
if($_SESSION['uid']){
$sql = "SELECT * FROM users WHERE id = '" . $_SESSION['uid'] . "'";
$res = mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($res) == 0){
session_destroy();
echo "Please <a href='login2.php'>Login</a> to your account, or <a href='reg.php'>Register</a> a new account!\n";
}else{
$row = mysql_fetch_assoc($res);
echo "Welcome back,<a href=\"forum-index.php?act=profile&id=".$row['id']."\">".$row['username']."</a>! <a href=\"logout.php\">Logout</a>\n";
echo "<br>\n";
echo " <a href=\"forum-index.php\">Forum Index</a>\n";
if($row['admin'] == '1'){
echo " | <a href=\"admin/index.php\">Adminastrators section</a>\n";
}
}
}else{
echo "Please <a href='login2.php'>Login</a> to your account, or <a href='reg.php'>Register</a> a new account!\n";
}
$admin_user_level = $row['admin'];
?>
</div>
<div id="content">
<?php
if(!$action || !in_array($action,$actions_array)){
$sql1 = "SELECT * FROM forum_cats WHERE admin < ".$row['admin']. "+1";
$res1 = mysql_query($sql1) or die(mysql_error());
$i=1;
while ($row2 = mysql_fetch_assoc($res1)){
echo "<div id='fcontent'>\n";
echo "<div class='header' id=\"header_".$i."\" onMouseOver=\"this.className='headerb'\" onMouseOut=\"this.className='header'\">".$row2['name']."</div>\n";
$sql2 = "SELECT * FROM forum_sub_cats WHERE cid='".$row2['id']."' AND admin < ".$row['admin']."+1";
$res2 = mysql_query($sql2) or die(mysql_error());
while($row3 = mysql_fetch_assoc($res2)){
echo "<div id='content'>\n";
echo "<a href=\"forum-index.php?act=forum&id=".$row3['id']."\">".$row3['name']."</a><br>\n";
echo " " .$row3['desc'] . "\n";
echo "</div>\n";
}
echo "</div>\n";
$i++;
}
}else{
if($action == 'forum'){
include "includes/forum.php";
}
if($action == 'create'){
include "includes/create.php";
}
if($action == 'topic'){
include "./includes/topic.php";
}
if($action == 'reply'){
include "./includes/reply.php";
}
}
?>
</div>
</div>
</center>
</body>
</html>
global.php
<?php
$con = mysql_connect(localhost, "843739" , "tigger");
$db = mysql_select_db(843729, $con);
function mss($value){
return mysql_real_escape_string(trim(strip_tags($value)));
}
function topic_go($id){
echo "<meta http-equiv=\"refresh\" content=\"0;url=forum-index.php?act=topic&id=".$id."\">";
}
function s($value){
return stripslashes($value);
}
function topic($input){
//bbcode
return nl2br(strip_tags(stripslashes(htmlspecialchars($input))));
}
function uid($uid, $link = FALSE){
$sql = "SELECT username FROM users WHERE id='".$uid."'";
$res = mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($res) == 0){
return "Invalid User";
}else{
$row = mysql_fetch_assoc($res);
if(!$link){
return $row['username'];
}else{
return "<a href=\"./forum-index.php?act=profile&id=".$uid."\"><font size=\"2\">".$row['username']."</font></a>\n";
}
}
}
function posts($uid){
$sql2 = "SELECT * FROM forum_replies WHERE uid='".$uid."'";
$res2 = mysql_query($sql2) or die(mysql_error());
return mysql_num_rows($res2);
}
function isa($uid){
$sql3 = "SELECT admin FROM users WHERE id='".$uid."'";
$res3 = mysql_query($sql3) or die(mysql_error());
$row = mysql_fetch_assoc($res3);
return $row['admin'];
}
?>
topic.php [old]
<?php
$id = $_GET['id'];
$page = (!$_GET['page'] || $_GET['page'] < 0) ? "1" : $_GET['page'];
$page = ceil($page);
$limit = 10;
$start = $limit;
$end = $page*$limit-($limit);
if(isset($id)){
$sql = "SELECT * FROM forum_topics WHERE id='".$id."'";
$res = mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($res) == 0){
echo "This topic does not exist!\n";
}else{
$row = mysql_fetch_assoc($res);
$sql2 = "SELECT admin FROM forum_sub_cats WHERE id='".$row['cid']."'";
$res2 = mysql_query($sql2) or die(mysql_error());
$row2 = mysql_fetch_assoc($res2);
if($row2['admin'] == 1 && $admin_user_level == 0){
echo "You cannot view this topic because you are not an admin!\n";
}else{
$a = (isa($row['uid'])) ? "<font style=\"color:#800000;\">ADMIN</font>" : "";
$amount_check = "SELECT * FROM forum_replies WHERE tid='".$tid."'";
$amount_check_res = mysql_query($amount_check) or die(mysql_error());
$amount_count = mysql_num_rows($amount_check_res);
$pages = 4;
$previous = ($page-1 <= 0) ? "« Prev" : "<a href=\"./forum-index.php?act=topic&id=".$id."&page=".($page-1)."\">« Prev</a>";
$nextpage = ($page+1 > $pages) ? " Next »" : " <a href=\"./forum-index.php?act=topic&id=".$id."&page=".($page+1)."\">Next »</a>";
echo $previous;
for($i=1;$i<=$pages;$i++){
$href = ($page == $i) ? " ".$i." " : " <a href=\"./forum-index.php?act=topic&id=".$id."&page=".$i."\">".$i."</a> ";
echo $href;
}
echo $nextpage;
echo "</td></tr>\n";
echo "<table border=\"0\" width=\"100%\" cellspacing=\"3\" cellpadding=\"3\">\n";
echo "<tr><td colspan=\"2\" align=\"left\" class=\"forum_header\"><b><font size=\"3\">".$row['title']."</font></b><font size=\"3\"> - Posted On: <em>".$row['date']."</em></font></td></tr>\n";
echo "<tr><td align=\"left\" width=\"15%\" valign=\"top\" class=\"forum_header\">".uid($row['uid'], true)."<br>Posts: ".posts($row['uid'])."<br>".$a."</td>\n";
echo "<td align=\"left\" valign=\"top\" class=\"forum_header\">";
echo topic($row['message']);
echo "</td>\n";
echo "</tr>\n";
$select_sql = "SELECT * FROM `forum_replies`WHERE tid = ".$id." ORDER BY id ASC LIMIT ".$end.", ".$start."";
$select_res = mysql_query($select_sql) or die(mysql_error());
while($rowr = mysql_fetch_assoc($select_res)){
echo "<tr><td colspan=\"2\" align=\"left\" class=\"forum_header\"><font size=\"3\"> - Posted On: <em>".$rowr['date']."</em></font></td></tr>\n";
echo "<tr><td align=\"left\" width=\"15%\" valign=\"top\" class=\"forum_header\">".uid($rowr['uid'], true)."<br>Posts: ".posts($rowr['uid'])."<br>".$a."</td>\n";
echo "<td align=\"left\" valign=\"top\" class=\"forum_header\">";
echo topic($rowr['message']);
echo "</td>\n";
echo "</tr>\n";
}
echo "<form method=\"post\" action=\"./forum-index.php?act=reply&id=".$row['id']."\">\n";
echo "<tr><td colspan=\"2\" align=\"center\"><textarea style=\"width:90%\" name=\"reply\"></textarea><br><input type=\"submit\" name=\"submit\" value=\"add reply!\" style=\"width:90%\" /></td></tr>\n";
echo "</table>\n";
}
}
}else{
echo "Please view a valid topic!\n";
}
?>
create.php
<?php
include("../global.php");
$id = mss($_GET['id']);
if(isset($id)){
$sql = "SELECT * FROM `forum_sub_cats` WHERE `id`='$id'";
$res = mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($res) == 0){
echo "The forum you are trying to create a topic on does not exist!\n";
}else{
$row1 = mysql_fetch_assoc($res);
if($row1['admin'] !== 1 && $admin_user_level == 0){
echo "You are not an administrator, you have no right to post on this forum!\n";
}else{
if(!$_POST['submit']){
echo "<table border=\"0\" cellspacing=\"3\" cellpadding=\"3\">\n";
echo "<form method=\"post\" action=\"forum-index.php?act=create&id=" . $id . "\">\n";
echo "<tr><td>Forum Sub Category</td><td><select name=\"cat\">\n";
$sql2 = "SELECT * FROM `forum_cats` WHERE `admin` < " . $admin_user_level . "+1";
$res2 = mysql_query($sql2) or die(mysql_error());
while ($row = mysql_fetch_assoc($res2)){
$rowid = $row['id'];
$sql3 = "SELECT * FROM `forum_sub_cats` WHERE `cid`='$rowid'";
$res3 = mysql_query($sql3) or die(mysql_error());
echo "<option value=\"0\">" . $row['name'] . "</option>\n";
while($row2 = mysql_fetch_assoc($res3)){
if($row2['id'] == $id){
$selected = " SELECTED";
}
echo "<option value=\"" . $row2['id'] . "\"" . $selected . "> " . $row2['name'] . "</option>\n";
}
}
echo "</select></td></tr>\n";
echo "<tr><td>Topic Title</td><td><input type=\"text\" name=\"title\"></td></tr>\n";
echo "<tr><td>Message</td><td><textarea name=\"message\" style=\"width:300px;height:100px;\"></textarea></td></tr>\n";
echo "<tr><td colspan=\"2\" align=\"right\"><input type=\"submit\" name=\"submit\" value=\"Create Topic\"></td></tr>\n";
echo "</form></table>\n";
}else{
$cat = mss($_POST['cat']);
$title = mss($_POST['title']);
$msg = mss($_POST['message']);
if(isset($cat) && isset($title) && isset($msg)){
$sql1 = "SELECT admin FROM forum_sub_cats WHERE id='$cat'";
$res1 = mysql_query($sql1) or die(mysql_error());
if(mysql_num_rows($res1) == 0){
echo "The forum sub category does not exist!\n";
}else{
$row = mysql_fetch_assoc($res1);
if($row['admin'] == 1 && $admin_user_level != 1){
echo "You are not an admin, you cannot post here!\n";
}else{
if(strlen($title) < 3 || strlen($title) > 60){
echo "The title must be between 3 and 60 chracters!\n";
}else{
if(strlen($msg) < 3 || strlen($msg) > 500){
echo "The message must be between 3 and 500 characters!\n";
}else{
$date = date("m-d-y") . " at " . date("h:i:s");
$time = time();
$sessionuid = $_SESSION['uid'];
$sql3 = "INSERT INTO forum_topics (cid,title,uid,date,time,message) VALUES('$cat','$title','".$_SESSION['uid']."','$date','$time','$msg')";
$res3 = mysql_query($sql3) or die(mysql_error());
$tid = mysql_insert_id();
topic_go($tid);
header("Location: forum-index.php");
}
}
}
}
}else{
echo "Please supply all the fields!\n";
}
}
}
}
}
?>
forum.php
<?php
include "(../global.php)";
function isInteger($input){
return preg_match('@^[-]?[0-9]+$@',$input) === 1;
}
function ShowTopics($forumid){
$sql = "SELECT * FROM `forum_topics` WHERE `cid`='$forumid' ORDER BY time DESC";
$res = mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($res) == 0){
echo "There are no topics in this forum, <a href=\"./forum-index.php?act=create&id=" . $forumid . "\">click here</a> to create a topic!\n";
}else{
echo "<table border=\"0\" cellspacing=\"3\" cellpadding=\"3\" width=\"100%\" style=\"font-size:12px\">\n";
echo "<tr><td colspan=\"3\" align=\"right\"><font size=\"3\"><a href=\"./forum-index.php?act=create&id=". $forumid ."\">create topic</a></font></td></tr>\n";
echo "<tr align=\"center\"><td><font size=\"3\">Title</font></td><td><font size=\"3\">User</font></td><td><font size=\"3\">Date</font></td><td><font size=\"3\">Replies</font></td></tr>\n";
while($row2 = mysql_fetch_assoc($res)){
$sql3 = "SELECT count(*) AS num_replies FROM forum_replies WHERE tid='".$row2['id']."' ORDER BY time DESC";
$res3 = mysql_query($sql3) or die(mysql_error());
$row3 = mysql_fetch_assoc($res3);
echo "<tr align=\"center\"><td><font size=\"3\"><a href=\"./forum-index.php?act=topic&id=".$row2['id']."\">".s($row2['title'])."</a></font></td><td><font size=\"3\">".uid($row2['uid'])."</font></td><td><font size=\"3\">".$row2['date']."</font></td><td><font size=\"3\">".$row3['num_replies']."</font></td></tr>\n";
}
echo "</table>\n";
}
}
$id = $_GET['id'];
if(isInteger($id)){
$sql1 = "SELECT * FROM `forum_sub_cats` WHERE `id`=$id";
$res1 = mysql_query($sql1) or die(mysql_error());
if(mysql_num_rows($res1) == 0){
echo "The forum sub category you supplied does not exist!\n";
} else {
$row = mysql_fetch_assoc($res1);
if($row['admin'] > 0){
if($admin_user_level > 0){
ShowTopics($row['id']);
} else {
echo "You must be an admin to view this forum!\n";
}
} else {
ShowTopics($row['id']);
}
}
}
?>
reply.php
<?php
ini_set('display_errors', 'On');
error_reporting(E_ALL | E_STRICT);
if(!$_POST['submit']){
echo "Invalid Usage of file!\n";
}else{
$tid = $_GET['id'];
$msg = $_POST['reply'];
if(!$tid){
echo "You did not supply a topic to reply to!\n";
}else{
$sql = "SELECT * FROM forum_topics WHERE id='$tid'";
$res = mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($res) == 0){
echo "This topic does not exist!\n";
}else{
$row = mysql_fetch_assoc($res);
$sql2 = "SELECT admin FROM forum_sub_cats WHERE id='{$row['cid']}'";
$res2 = mysql_query($sql2) or die(mysql_error());
$row2 = mysql_fetch_assoc($res2);
if($row2['admin'] == 1 && $admin_user_level == 0){
echo "You cannot post here, this is because you are not an admin!\n";
}else{
if(!$msg){
echo "You did not supply a message for the reply!\n";
}else{
if(strlen($msg) < 10 || strlen($msg) > 10000){
echo "Your reply must be between 10 and 10000 characters!\n";
}else{
$sessionuid = $_SESSION['uid'];
$date = date("m-d-y") . " at " . date("h:i:s");
$time = time();
$sql3 = "INSERT INTO `forum_replies` (`tid`,`uid`,`message`,`date`,`time`) VALUES('".$tid."','".$_SESSION['uid']."','".$msg."','".$date."','".$time."')";
$res3 = mysql_query($sql3) or die(mysql_error());
$sql4 = "UPDATE `forum_topics` SET `time`='".time()."' WHERE `id`='".$tid."'";
$res4 = mysql_query($sql4) or die(mysql_error());
header("Location: forum-index.php?act=topic&id=".$tid);
}
}
}
}
}
}
?>
and thats all of them
