chat?

<?php
if(isset($_GET["action"])){$action = $_GET["action"];
}else{$action = "null";}

if(isset($_GET["password"])){$password = $_GET["password"];
}
if(isset($_GET["username"])){$username = $_GET["username"];
}
$conn = new mysqli("127.0.0.1", "root", "", "nitto");
$date = date("Y-m-d H:i:s");
if($action == "getRoomList"){
	//roomPassword1=0 means public






	$resultGetRooms = $conn->query("SELECT * FROM rooms ORDER BY Perm,roomName ASC LIMIT 100");
	$i=0;
	while ($row = $resultGetRooms->fetch_assoc())
	{
	$i++;
	$roomID = $row["roomID"];
	$resultRoomCount = $conn->query("SELECT * FROM sessions WHERE roomID='$roomID'");
	$count1 = mysqli_num_rows($resultRoomCount);
		if($row['roomPassword'] != "")
			$password = "1";
		else
			$password = "0";
		print "roomName" .$i. "=" .$row["roomName"]. "&roomCount".$i."=" .$count1. "&roomID".$i."=".$row["roomID"]."&roomPassword".$i."=".$password."&";


	}




}

if($action == "getRoomMessages"){
	if(isset($_GET["roomID"])){$roomID = $_GET["roomID"];}
	if(isset($_GET["userName"]))$userName = $_GET["userName"];




		//Update creation time because user is still in there and don't want it deleted.
		$conn->query("UPDATE rooms SET CreationTime='$date' WHERE roomID='$roomID'");
		//Check and delete unused user created rooms after 30 seconds if no users.
		$date2 = date('Y-m-d H:i:s', strtotime($date) - 30);//Check creation date vs 30 seconds ago.
		$conn->query("DELETE FROM rooms WHERE Perm='1' AND CreationTime < '$date2'");
		//Check and delete unused user created rooms after 30 seconds.^^

		//roomPassword1=0 means public


		//Remove any user not in a room for 30 seconds.

		$conn->query("UPDATE sessions SET roomID='0' WHERE DATETIME < '$date2'");

		//Update chat whether this user is in a room or not.

		$conn->query("UPDATE sessions SET roomID='$roomID', DATETIME='$date' WHERE Name='$userName'");
		//if this user does not exist in session table then we insert him. only once though.
		$result = $conn->query("SELECT * FROM sessions WHERE Name='$userName'");
		$count = mysqli_num_rows($result);
		if($count == 0){
		echo"asdf";

		$conn->query("INSERT INTO sessions (IP, Session, Name, roomID, DATETIME, mute)
		VALUES ('', '', '$userName', '$roomCount', '$date', '0')");

		}





	echo'newMessage=';
	$result = $conn->query("SELECT * FROM chatMessages WHERE roomID='$roomID' ORDER BY DATETIME LIMIT 30");
	while ($row = $result->fetch_assoc())
	{
	$name = $row["Name"];
	$resultCheckMute = $conn->query("SELECT * FROM sessions WHERE Name='$name' AND mute='1'");
	$count = mysqli_num_rows($resultCheckMute);


		if($count == "1" && $row["Name"] == $userName){
		print '<B>System->'.$row["Name"]. ': </B><font color="#cc99ff">You are still muted. Your messages will be recorded but not shown.</font><BR>';
		}
		else if($count == "1"){}

		//possible mod color#0066ff.

		else if($row["PLVL"] == "admin"){
			print '<B>'.$row["Name"]. ': </B><font color="#FFD700">' .$row["Message"]. '</font><BR>';
		}
		else if($row["PLVL"] == "system"){
			print '<B>'.$row["Name"]. ': </B><font color="#cc99ff">' .$row["Message"]. '</font><BR>';
		}
		else{
			print '<B>'.$row["Name"]. ': </B>' .$row["Message"]. '<BR>';}




}

	$result = $conn->query("SELECT * FROM chatMessages WHERE MessageTo='$userName' AND imRead='1' ORDER BY DATETIME LIMIT 30");
	$i=0;
while ($row = $result->fetch_assoc())
{
	$i++;
		if($row["PLVL"] == "admin"){

			print '&instantMessageFrom' .$i. '='.$row["Name"]. '&instantMessageFromID' .$i. '=' .$row["Name"].  '&instantMessage' .$i. '=<font color="#FFD700">' .$row["Message"]. '</font>';
		}
		else{
			print '&instantMessageFrom' .$i. '='.$row["Name"]. '&instantMessageFromID' .$i. '=' .$row["Name"]. '&instantMessage' .$i. '='.$row["Message"];}
			$ID = $row["ID"];
		//mark im read
	$conn->query("UPDATE chatMessages SET imRead='0' WHERE MessageTo='$userName' AND ID='$ID'");

}


}

if($action == "sendRoomMessage"){
	//NEEDS ADMIN PRIVS


	if(isset($_GET["roomID"]))
		$roomID = $_GET["roomID"];
	if(isset($_GET["userName"]))$username = $_GET["userName"];

	if(isset($_GET["message"]))
	$message = $_GET["message"];
	if($username != "McBane"){$plvl = "user";}
	else{$plvl = "admin";
	$str = explode(' ', $message);
	$command = substr(strrchr($str[0], '/'), 1);

	if (isset($str[1]))
        {
			if($str[0] == "/mute"){
            $message = $str[1]. " has been muted for 1 hour!";
			$username = "System";
			$plvl = "system";
			$conn->query("UPDATE sessions SET mute='1' WHERE Name='$str[1]'");
			}
			else if($str[0] == "/unmute"){
            $message = $str[1]. " has been unmuted!";
			$username = "System";
			$plvl = "system";
			$conn->query("UPDATE sessions SET mute='0' WHERE Name='$str[1]'");}
        }


	}
	/// needs a username and password check?
$message = strip_tags($message);//remove html
	$conn->query("INSERT INTO chatMessages (ID, Name, PLVL, Message, DATETIME, roomID)
VALUES ('', '$username', '$plvl', '$message', '$date', '$roomID')");



}
if($action == "sendInstantMessage"){
	//NEEDS ADMIN PRIVS

	if(isset($_GET["roomID"]))
		$roomID = $_GET["roomID"];
	if(isset($_GET["userName"]))$username = $_GET["userName"];
	if(isset($_GET["messageTo"]))$messageTo = $_GET["messageTo"];
	if(isset($_GET["messageFrom"]))$messageFrom = $_GET["messageFrom"];

	if(isset($_GET["message"]))
	$message = $_GET["message"];
	if($messageFrom != "McBane"){$plvl = "user";}
	else{$plvl = "admin";}

	/// needs username and password check
	$message = strip_tags($message);//remove html
	$conn->query("INSERT INTO chatMessages (ID, Name, PLVL, Message, DATETIME, roomID, imRead, MessageTo)
VALUES ('', '$messageFrom', '$plvl', '$message', '$date', '$roomID', '1', '$messageTo')");



}
if($action == "getRoomMembers"){
	//roomPassword1=0 means public
		if(isset($_GET["roomID"])){$roomID = $_GET["roomID"];}

//echo"userName1=Admin&status1=0&clickable1=1&type=admin&accountID1=1&memberLevel1=0";
	$result = $conn->query("SELECT * FROM sessions WHERE roomID='$roomID' ORDER BY NAME ASC LIMIT 100");
	$i=0;
while ($row = $result->fetch_assoc())
{
$i++;
		if($row["Name"] == "McBane"){$plvl = "admin";$m = "1";}
		else{$plvl = "user"; $m = "0";}

		print "userName" .$i. "=" .$row["Name"]. "&status" .$i. "=0&clickable" .$i. "=1&type" .$i. "=" .$plvl. "&accountID" .$i. "=" .$row["Name"]. "&memberLevel" .$i. "=".$m."&";


}
echo"&roomNumber=" .$i;

}

if($action == "checkRoomPassword"){

		if(isset($_GET["roomID"])){$roomID = $_GET["roomID"];}
		if(isset($_GET["roomPassword"])){$roomPassword = $_GET["roomPassword"];}


	$result = $conn->query("SELECT * FROM rooms WHERE roomID='$roomID' AND roomPassword='$roomPassword'");
	$count = mysqli_num_rows($result);

	if($count == 1){

		echo"status=1";

	}
	else{echo"status=0";}

}
if($action == "createRoom"){

		if(isset($_GET["roomName"])){$roomName = $_GET["roomName"];}
		if(isset($_GET["roomPassword"])){$roomPassword = $_GET["roomPassword"];}


	$result = $conn->query("SELECT * FROM rooms WHERE roomName='$roomName'");
	$count = mysqli_num_rows($result);

	if($count == 1){

		echo"status=0";

	}
	else{
		//NEEDS ADMIN PRIVS TO SKIP PASSWORD
		//Perm = 1 means user created room. 0 means static room.

	$sqlCreate = "INSERT INTO rooms (roomName, Perm, CreationTime, roomPassword)
VALUES ('$roomName', '1', '$date', '$roomPassword')";
		if ($conn->query($sqlCreate) === TRUE) {
		$last_id = $conn->insert_id;
		echo"status=1&roomID=" .$last_id;

		}
		else{
		echo"status=0";}


	}

}







?>