new_one

<?php
session_start();
include("config.php");

// Connect to server and select database.
mysql_connect($host, $db_user, $db_pass)or die("cannot connect server ");
mysql_select_db($db_name)or die("cannot select DB");

$id=$_GET['id'];
$action=$_GET['action'];
if (!isset($_SESSION['admin']))
        die("Hacking Attempt!");

if ($action == 'edit') {

        $sql="SELECT * FROM $gb_tbl_name WHERE id=$id";
        $result=mysql_query($sql);
        while($rows=mysql_fetch_array($result)) {
?>
        <form name="edit" method="post" action="addguestbook.php?action=edit2">
                Id: <input type="text" name="id" value="<? echo $rows['id']; ?>" /><br />
                Name: <input type="text" name="name" value="<? echo $rows['name']; ?>" /><br />
                Email: <input type="text" name="email" value="<? echo $rows['email']; ?>" /><br />
                Comment: <textarea name="comment"><? echo $rows['comment']; ?></textarea> <br />
                Edit:   <input type="radio" name="edit" value="name">Name
                                <input type="radio" name="edit" value="email">Email
                                <input type="radio" name="edit" value="comment">Comment <br />
                <input type="submit" name="submit" value="Edit!">
        </form>

<?
}
}
elseif ($action == 'edit2') {
        $id=$_POST['id'];
        $field=$_POST['edit'];
        if ($field='name')
                $new_value=mysql_real_escape_string($_POST['name']);
        elseif ($field='email')
                $new_value=mysql_real_escape_string($_POST['email']);
        else
                $new_value=mysql_real_escape_string($POST['comment']);

        $sql="UPDATE $gb_tbl_name SET $field = $new_value WHERE `id` = $id";
        mysql_query($sql);
        header('Location: viewguestbook.php');
        exit()
}
elseif ($action == 'delete') {
        $sql="DELETE FROM $gb_tbl_name WHERE id=$id";
        mysql_query($sql);
        header('Location: viewguestbook.php');
}
elseif ($_POST['name'] != NULL || $_POST['comment'] != NULL) {
$name=mysql_real_escape_string($_POST['name']);
$email=mysql_real_escape_string($_POST['email']);
$comment=mysql_real_escape_string($_POST['comment']);
$datetime=date("d-m-y h:i");

$sql="INSERT INTO $gb_tbl_name (name, email, comment, datetime) VALUES ('$name', '$email', '$comment', '$datetime')";
mysql_query($sql);
header('Location: viewguestbook.php');
exit()
}
elseif (is_null($action))
        echo "You must be logged in as an admin to delete / edit";
else
        echo "You have to fill in your Name and Comment";

mysql_close();
?>