1C upload

if ($_GET['file'] and $_GET['table']) {
    $xml = simplexml_load_file($_GET['file']);
    $products = $xml->ПакетПредложений->Предложения->Предложение;
    $properties = $xml->Классификатор->Свойства->Свойство;
    foreach ($properties as $property) {
        if ($property->БитриксКод) {
            $id = (string)$property->Ид;
            $prop_arr[$id] = $property->БитриксКод;
            //echo $property->БитриксКод;
        }
        //else echo $property->Ид;
        //echo " - ".$property->Наименование."<br />";
    }

    foreach ($products as $product) {
        $fields = array();
        $values = array();
        $FOTO = array();

        $fields[] = "Name";
        $values[] = str_replace("'", "&#39;", $product->Наименование);;
        $fields[] = "Photo";
        $values[] = $product->Картинка;
        foreach ($product->ЗначенияСвойств->ЗначенияСвойства as $prop) {
            if(!empty($prop->Значение)) {
                $id = (string)$prop->Ид;
                if (ctype_digit($id)) {
                    $id = $prop_arr[$id];
                }
                if (strpos($id, "FOTO")===false) {
                    $fields[] = $id;
                    $html = html_entity_decode($prop->Значение);
                    //$html = strip_tags($html, '<table><tbody><tr><th><td><strong><p><img>');
                    $values[] = str_replace("'", "&#39;", $html);
                }
                else $FOTO[] = $prop->Значение;

                //$sql .= $id." => ".$prop->Значение."\n";
            }
        }
        $fields[] = "FOTO";
        $values[] = implode(":", $FOTO);
        $fields[] = "Price";
        $values[] = $product->Цены->Цена->ЦенаЗаЕдиницу;
        $fields[] = "Currency";
        $values[] = $product->Цены->Цена->Валюта;

        $sql = "INSERT INTO Message2000 (Subdivision_ID, Sub_Class_ID, ".implode(",", $fields).") VALUES ('33', '45', '".implode("', '", $values)."')";
        if (mysql_query($sql)) echo $values[0]." inserted<br />";
        else echo $values[0]. "error: ".mysql_error()."<br />";

    }
}
elseif (isset($_GET['replace'])) {
    $res = mysql_query("SELECT * FROM Message2000 WHERE Message_ID>'1'");
    while ($row = mysql_fetch_array($res, MYSQL_ASSOC)) {
        echo $row['Message_ID'];
        if ($row['CML2_DETAIL_TEXT']) {
            //$text = preg_replace(array("/об\S+/", "/возду\S+/", "/вне\S+/", "/ча\S+/", "/кры\S+ка-чехол/"), array("обшивки", "воздушный", "внешней", "чаши", "крышка-чехол"), $row['CML2_DETAIL_TEXT']);

            if (mysql_query("UPDATE Message2000 SET CML2_DETAIL_TEXT='".html_entity_decode($text, '', 'UTF-8')."' WHERE Message_ID='". $row['Message_ID']."'")) {
                echo " updated successfully<br />";
            }
            else echo " error: ".mysql_error()."<br />";
        }
        else echo " no text";
    }
}