Untitled

<html>
<head>
<title>Web GM ticket tracker</title>
</head>
<body>
<?php
  $host = "db.undzwei.eu";
  $user = "ascent";
  $pass = "mexis:U2";
  $char_db = "a_char";
  $logon_db = "a_logon";

  if($_POST["sent"] AND !$_SESSION["acct"]) // Neni prihlasen, poslal prihlaseni
  {
    $conn = mysql_connect($host, $user, $pass);
    mysql_select_db($logon_db, $conn);

    $query = "SELECT acct, gm FROM accounts WHERE login = ".$_POST["login"]." AND password = ".$_POST["password"]." LIMIT 1";
    $response = mysql_query($query);
    $result = mysql_fetch_row($response);

    if($result["gm"] > 0 OR $result["gm"] != "") // Je GM
    {
      session_start();
      $_SESSION["acct"] = $result["acct"];
      header("Location: ".$_SERVER["PHP_SELF"]);
    }
  }

  elseif($_SESSION["acct"]) // Je prihlasen, zobrazime seznam ticketu
  {
    $conn = mysql_connect($host, $user, $password);
    mysql_select_db($char_db, $conn);
    $q = "SELECT guid, name, level, timestamp FROM ".$char_db.".gm_tickets";
    $query = mysql_query($q);
    echo "<table>
            <tr>
              <td colspan=2 align=center>Web GM ticket tracker</td>
            </tr>
            <form method=post action='".$_SERVER["PHP_SELF"]."'>
            <tr>
              <td colspan=2 align=center><font size=4>Actual GM tickets:</td>
            </tr>
            <tr>
              <td>GUID</td><td>Name</td><td>Level</td><td>Timestamp</td>
            </tr>
            </form>
          </table>";
    while($result = mysql_fetch_array($query)):
      echo "<tr>
              <td>".$result["guid"]."</td>
              <td>".$result["name"]."</td>
              <td>".$result["level"]."</td>
              <td>".$result["timestamp"]."</td>
              <td><a href=".$_SERVER["PHP_SELF"]."?t=".$result["guid"]."</td>
            </tr>";
    endwhile;
  }

  elseif($_SESSION["acct"] AND $_GET["t"]) // Je prihlasen, chce zobrazit urcity ticket
  {
    $conn = mysql_connect($host, $user, $pass);
    mysql_select_db($char_db, $conn);
    $t = mysql_real_escape_string($_GET["t"]);

    $q = "SELECT guid, name, level, message, timestamp FROM ".$char_db.".gm_tickets WHERE guid = ".$t." LIMIT 1";
    $response = mysql_query($query);
    if(mysql_num_rows($response)==0) die("Requested ticket does not exist.");
    $result = mysql_fetch_row($response);
    echo "<table>
            <tr>
              <td colspan=2 align=center>Web GM ticket tracker</td>
            </tr>
            <tr>
              <td colspan=2 align=center><font size=4>Tracking ticket #".$result["guid"]." by ".$result["name"]."</td>
            </tr>
            <tr>
              <td>GUID</td><td>Name</td><td>Level</td><td>Timestamp</td>
            </tr>
            <tr>
              <td>".$result["guid"]."</td><td>".$result["name"]."</td><td>".$result["level"]."</td><td>".$result["timestamp"]."</td>
            </tr>
            <tr>
              <td>Message:</td>
            </tr>
            <tr>
              <td>".$result["message"]."</td>
            </tr>
          </table>";
  }

  else // Neni prihlasen, neposlal prihlaseni
  {
    echo "<form method=post action='".$_SERVER["PHP_SELF"]."'>
            <tr>
              <td colspan=2 align=center><font size=4>Login</td>
            </tr>
            <tr>
              <td width=125>Account</td><td><input type=text name='login'></td>
            </tr>
            <tr>
              <td width=125>Password</td><td><input type=password name='password'></td>
            </tr>
            <input type=submit name='sent' value='Log in'>
          </form>";
  }
?>
</body>
</html>