<?php
session_start();
require('../mysql_connect_inc.php');
require('../header.php');

$oldnewssql = "
SELECT * FROM `news`
WHERE `newsid` = '" . $_GET['id'] . "'
";
$result = mysql_query($oldnewssql);
$oldnews = mysql_fetch_array($result);
?>

<form action="editnews.php?id=<?php echo $_GET['id'] ; ?>" method="POST" id="newspost">
Username<br />
<input type="text" name="user" value="<?php echo $_SESSION['username']; ?>" disabled="disabled" /><br />
Title <br />
<input type="text" name="updatetitle" value="<?php echo $oldnews['title']; ?>" maxlength="50"/><br />
News <br />
<textarea rows="10" cols="74" name="updatepost"><?php echo $oldnews['post']  ?></textarea>
<input type="submit" name="submit" value="Edit News" class="submit"/>
</form>

<?php
$sql=" UPDATE `news` SET
`title` = '" . mysql_real_escape_string($_POST['updatetitle']) . "', `post` = '" . mysql_real_escape_string($_POST['updatepost']) . "'
WHERE `newsid` = '" . $_GET['id'] . "'
";

mysql_query($sql);
require('../footer.php')
?>