PHP Forum V0.3

<?php
/*
*    +--------------------------------------------------------------+
*    | Changelog                                                    |
*    +--------------------------------------------------------------+
*    |                                                              |
*    | Version: 0.3                                                 |
*    |  0.3 > Simple Search                                         |
*    |  0.3 > Admin Login, delete posts/threads                     |
*    |  0.3 > Can not reply to non existing threads                 |
*    |  0.2 > Some other minor things                               |
*    |  0.2 > Threads with new reply go to the top                  |
*    |  0.2 > No blank posts                                        |
*    |  0.1 > Simple Threads, and posts                             |
*    |                                                              |
*    +--------------------------------------------------------------+
*
*    +--------------------------------------------------------------+
*    | Current MySQL User                                           |
*    +--------------------------------------------------------------+

CREATE USER 'forum_user'@'localhost' IDENTIFIED BY 'some password';

GRANT CREATE ON forum_db.* TO 'forum_user'@'localhost';
GRANT UPDATE ON forum_db.* TO 'forum_user'@'localhost';
GRANT SELECT ON forum_db.* TO 'forum_user'@'localhost';
GRANT INSERT ON forum_db.* TO 'forum_user'@'localhost';
GRANT DELETE ON forum_db.* TO 'forum_user'@'localhost';

*    +--------------------------------------------------------------+
*/
//INSERT INTO users VALUES (NULL, 'Admin', '5bc01684157d1fdfe1403bf87b44fafdfd4fb5db4df5033ee7bdd910dda5e8d36f7b39be4557542e444381448783948f90a906a780fca0a196aa29710d55c058', 'Admin');
// To get an admin hash a password in sha512 with the default salt, the default admin password ( ^ that one ) is '123456' (no quotes). The default salt is: "[%6#llKZ`dW£v:Qb5%eJbdpUAZ6ta#j&W'nb{{iQ5*S'IGa@:W" and is found in the admin function
session_start();
if ( !$_POST ) include_once('include/header.php');

$host = 'localhost';
$username = 'forum_user';
$password = 'password';
$database = 'forum_db';
connect($host, $username, $password, $database);

function connect($host, $username, $password, $database) {
    mysql_connect($host,$username,$password) or die("Could not connect. " . mysql_error());
    mysql_select_db($database) or die("Could not select database. " . mysql_error());
    return buildDB(); //Everytime the database is connected to, it will run the buildDB function to check if the tables exist and if not create them
}

function buildDB() {
    $SQL = <<<MySQL_QUERY
CREATE TABLE IF NOT EXISTS forum (
post_num INT NOT NULL AUTO_INCREMENT,
title VARCHAR(150),
user VARCHAR(50),
bodytext TEXT,
OP INT,
created VARCHAR(100),
last_post VARCHAR(100),
PRIMARY KEY(post_num)
);
MySQL_QUERY;
    mysql_query($SQL);
$SQL = <<<MySQL_QUERY
CREATE TABLE IF NOT EXISTS users (
userid INT NOT NULL AUTO_INCREMENT,
username VARCHAR(150),
password VARCHAR(150),
usergroup VARCHAR(40),
PRIMARY KEY(userid)
);
MySQL_QUERY;
    mysql_query($SQL);
}

function post($title, $user, $body, $OP, $time) {
    $title = mysql_real_escape_string($title);
    $user = mysql_real_escape_string($user);
    $body = mysql_real_escape_string($body);
    if ( strlen($body) > 2500 ) $body = substr($body, 0, 2500);
    $OP ? $OP = mysql_real_escape_string($OP) : $OP = 0;
    //if (mysql_num_rows(mysql_query("SELECT post_num FROM forum WHERE op=$OP")) == 0) $OP = 0;
    $SQL = "INSERT INTO forum VALUES (NULL, '$title', '$user', '$body', $OP,'$time', '$time');";
    mysql_query($SQL);
    $SQL = "UPDATE forum SET last_post='$time' WHERE post_num=$OP";
    mysql_query($SQL);
    header("Location: " . $_SERVER['PHP_SELF'] . "?id=" . $OP);
}

function get_thread() {
    $amount_page = 6;
    print "<form name=\"search\" method=\"get\"> <input type=\"text\" name=\"search\" placeholder=\"Search\" autocomplete=\"off\"> </form> <span id=\"manage\"><a href=\"?admin=1\"> [Manage] </a></span>";
    if ( !$_GET ) post_box();
    if ( $_GET ) print "<h4> <a href=\"".$_SERVER['PHP_SELF']."\">Return </a> </h4>";
    isset($_GET["page"]) ? $page = $_GET["page"] : $page = 1;
    $start_from = ($page-1) * $amount_page;
    if ( $_GET['id'] ) {
        if (!is_numeric($_GET['id']) || is_float($_GET['id']) || $_GET['id'] <= 0) { exit; } else { $OP = $_GET['id']; }
        $SQL = "SELECT * FROM forum WHERE OP=$OP OR post_num=$OP ORDER BY created ASC LIMIT $start_from, $amount_page";
    } elseif( $_GET['search'] ) {
        $OP = 0;
        $searchstring = mysql_real_escape_string(urldecode($_GET['search']));
        $SQL = "SELECT * FROM forum WHERE title LIKE '%$searchstring%' OR bodytext LIKE '%$searchstring%' ORDER BY last_post DESC LIMIT $start_from, $amount_page";
    } else {
        $OP = 0;
        $SQL = "SELECT * FROM forum WHERE OP=$OP ORDER BY last_post DESC LIMIT $start_from, $amount_page";
    }
    $result=mysql_query($SQL);
    //pages
    $pages = "<div id=\"pages\">";
    $pages_SQL = "SELECT COUNT($OP) from forum WHERE OP=$OP";
    $pages_result = mysql_query($pages_SQL);
    $pages_row = mysql_fetch_row($pages_result);
    $pages_total_records = $pages_row[0];
    $total_pages = ceil($pages_total_records / $amount_page);
    if (isset($_GET["page"])) { $currentpage = $_GET["page"]; } else { $currentpage = 1; };
    $currentpage = mysql_real_escape_string(htmlentities($currentpage));
    $pages .= "<span class=\"pages\">";
    if ($total_pages > 0 && $currentpage > 1) {
            $pages .= "<a href=\"?page=" . (intval($currentpage) - 1) . "\">Prev &laquo; </a>";
        }
        if ($total_pages > 1) {
            for ( $i= 1; $i <= $total_pages; $i++) {
                $pages .= "<a href=\"?page=$i\"> $i </a>  ";
                if ($i != $total_pages) {
                    $pages .=  " - ";
                }
            }
        }
        if ($total_pages > 0 && $currentpage != $total_pages && $total_pages > 1) {
            $pages .= "<a href=\"?page=" . (intval($currentpage) + 1) . "\"> &raquo; Next </a>";
        }
    $pages .= "</span>\n</div>";
    //end of pages
    print $pages;
    while ($db_field = mysql_fetch_assoc($result)) {
        $replyquery = "SELECT COUNT(*) FROM forum WHERE OP=".$db_field["post_num"];
        $replyresult = mysql_query($replyquery) or die(mysql_error());
        while($replyrow = mysql_fetch_array($replyresult)){
            $replies = $replyrow['COUNT(*)'];
        }
        print "<div class=\"thread\">\n<div class=\"title\">\n<h2>" . htmlentities(stripslashes($db_field["title"])) . "</h2>\n";
        if ( $_GET['id'] ) {
            print "<h4>" . htmlentities(stripslashes($db_field["user"])) . " - " . date('H:i', $db_field["created"]) . "</h4>\n";
        } else {
            print "<h4>" . htmlentities(stripslashes($db_field["user"])) . " - " . date('H:i', $db_field["created"]) . " - " . $replies . " Replies" . "</h4>\n";
        }
        print "</div>\n<div class=\"post_body\">\n<p>" . htmlentities(stripslashes($db_field["bodytext"])) . "</p>\n</div>\n";
        if ( !$_GET['id'] ) print "<h4> <a href=\"".$_SERVER['PHP_SELF']."?id=".$db_field["post_num"]."\">Read more... </a> </h4>";
        print "</div>";
        if ( $db_field["OP"] == 0 && $_GET['id'] ) { print "<div id=\"replies\">"; }
    }
    if ($_GET['id']) print "</div>";
    if ( $_GET['id'] ) post_box();
}

function post_box() {
    print <<<POST_FORM
<a id="link1" href="javascript:display('show')"> Make Post </a>
<div id="postform" style="display:none">
<form method="post" >
    <div class="clear"></div>
    <label for="title">Title: </label><br />
    <input name="title" id="title" type="text" maxlength="150" placeholder="Title"/><br>
    <div class="clear"></div>
    <label for="name">Name: </label><br />
    <input name="name" id="name" type="text" maxlength="50" value="Anon"/><br>
    <div class="clear"></div>
    <label for="message">Message: </label>Maximum of 2500 Characters
    <textarea name="bodytext" id="bodytext" maxlength=2500 placeholder="Message"></textarea><br>
    <input type="submit" value="Submit" />
</form>
</div>
POST_FORM;
}

function admin() {
    if(isset($_SESSION['username'])){
        $username = mysql_real_escape_string($_SESSION['username']);
        $result=mysql_query("SELECT username FROM users WHERE username='$username'");
        $loggedin=mysql_num_rows($result);
        if($loggedin!==1) exit;
        print "Logged in as: <span class=\"user\"> " . $_SESSION['username'] . " <a href=\"?logout=1\"> [Logout] </a></span>";
        $SQL = "SELECT * FROM forum ORDER BY last_post DESC";
        $result = mysql_query($SQL);
        print "<div id=\"admin_posts\">";
        while ($db_field = mysql_fetch_assoc($result)) {
            $title = htmlentities(stripslashes($db_field["title"]));
            $user = htmlentities(stripslashes($db_field["user"]));
            $text = htmlentities(stripslashes($db_field["bodytext"]));
            $post_num = htmlentities(stripslashes($db_field["post_num"]));
            $op = htmlentities(stripslashes($db_field["op"]));
            print <<<ADMIN_PANEL
<div class="thread"><div class="title"> Title: $title Author: $user Post #: $post_num</div>
<p> $text </p> <form method="get"><input type="hidden" value="1" name="admin" /><input type="hidden" value="{$post_num}" name="edit" /><input type="submit" value="Edit" ></form><form method="get"><input type="hidden" value="1" name="admin" /><input type="hidden" value="{$post_num}" name="delete" /><input type="submit" value="Delete" > <input type="checkbox" name="all" value="true" /> Remove sub-posts </form></div>
ADMIN_PANEL;
    if ( $_GET['delete'] ) {
        $post_num = mysql_real_escape_string($_GET['delete']);
        if ( $_GET['all'] == "true" ) { $SQL = "DELETE FROM forum WHERE post_num=$post_num OR OP=$post_num"; } else { $SQL = "DELETE FROM forum WHERE post_num=$post_num"; }
        mysql_query($SQL);
    }
    }
    print "</div>";
    } elseif ( $_POST ) {
        $username = mysql_real_escape_string($_POST['username']);
        $password = hash_hmac('sha512', mysql_real_escape_string($_POST['password']), "[%6#llKZ`dW£v:Qb5%eJbdpUAZ6ta#j&W'nb{{iQ5*S'IGa@:W"); //hashes the password in sha512 with a 50 character salt
        $SQL = "SELECT username FROM users WHERE username='$username' and password='$password'";
        $result=mysql_query($SQL);
        $loggedin=mysql_num_rows($result);
        while ($db_field = mysql_fetch_assoc($result)) {
            $id = $db_field['user_id'];
        }
        if($loggedin==1) {
            setCookie("username", $username, time()+36000);
            $_SESSION['username'] = $username;
            header("Location: " . $_SERVER['PHP_SELF'] . "?admin=1");
        } else {
            header("Location: " . $_SERVER['PHP_SELF']);
        }
    } else {
    print <<<ADMIN
<div id="adminform">
<form method="post" action="{$_SERVER['PHP_SELF']}?admin=1">
    <label for="Username">Username: </label><br />
    <input name="username" id="username" type="text" maxlength="150" /><br>
    <div class="clear"></div>
    <label for="password">Password: </label><br />
    <input name="password" id="password" type="password" maxlength="150" /><br>
    <input type="submit" value="Submit" />
</form>
</div>
ADMIN;
    }
}

if ( $_POST['bodytext'] ) {
    post($_POST['title'],$_POST['name'],$_POST['bodytext'],$_GET['id'],time());
} elseif ( $_GET['admin'] == 1 || $_POST['username']) {
    admin();
} elseif ( $_GET['logout'] == 1 ) {
    session_unset();
    session_destroy();
    header("Location: " . $_SERVER['PHP_SELF']);
} else {
    get_thread();
}

include_once('include/footer.php');

?>