<?php


include('mysql.php');
include('functions.php');

if ($_POST['winner'] == $_POST['first'])
{
    $looserId = $_POST['second'];
    $winnerId = $_POST['first'];
}
else
{
    $looserId = $_POST['first'];
    $winnerId = $_POST['second'];
}

    // POST the winner
    // Так делать не стоит, есть потенциальная SQL INJECTION.
    $result = mysql_query("SELECT * FROM images WHERE image_id = ".$winnerId." ");
    $winner = mysql_fetch_object($result);


    // POST the looser
    // Опятьже SQL INJECTION. Все полседующие запросы в базу также не безопастны.
    $result = mysql_query("SELECT * FROM images WHERE image_id = ".$looserId." ");
    $looser = mysql_fetch_object($result);


    // Update the winner score
    $winner_expected = expected($looser->score, $winner->score);
    $winner_new_score = win($winner->score, $winner_expected);
        //test print "Winner: ".$winner->score." - ".$winner_new_score." - ".$winner_expected."<br>";
    mysql_query("UPDATE images SET score = ".$winner_new_score.", wins = wins+1 WHERE image_id = ".$winnerId);


    // Update the looser score
    $looser_expected = expected($winner->score, $looser->score);
    $looser_new_score = loss($looser->score, $looser_expected);
        //test print "looser: ".$looser->score." - ".$looser_new_score." - ".$looser_expected."<br>";
    mysql_query("UPDATE images SET score = ".$looser_new_score.", losses = losses+1  WHERE image_id = ".$looserId);


    // Insert battle
    mysql_query("INSERT INTO battles SET winner = ".$winnerId.", looser = ".$looserId." ");


    // Back to the frontpage
    header('location: /');


?>