comp353/edit_ad.php at master · mariegobran/comp353 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
<?php
   include("session.php");
   include("config.php");
   error_reporting(E_ALL);
   ini_set('display_errors','On');
   if($_SERVER["REQUEST_METHOD"] == "POST"  && isset ($_POST['Edit'])){

   $_SESSION['adModify']=$_POST["Edit"];
   $selectedAd=$_POST["Edit"];
   echo "selected ad" .$selectedAd;

   // get all the ad data
   $sql = "SELECT * FROM ads WHERE AdID = '$selectedAd'";
   $result = mysqli_query($conn,$sql);
   $row = $result->fetch_assoc();

    // save all ad default values
    $ownerID = $row['ownerID'] ;
    $Title =$row['title'] ;
    $description=$row['description'] ;
    $price=$row['price'] ;
    $address=$row['address'] ;
    $phone=$row['phone'] ;
    $email=$row['email'] ;
    $image=$row['image'] ;
    $city=$row['city'];
    $category=$row['category'];
    $promotion=$row['promotion'];
  }
   //get usetype and userID saved in session and check if the user is not
   // either the admin or the ad owner (then they're not allowed to modify the ad)
   if(!($_SESSION['usetype']=="Admin" || $_SESSION['userID']== $ownerID)){
       header ("location: index.php");
   }

//submit changes
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  if (isset($_POST['change'])) {
//get values from the form

$Title = mysqli_real_escape_string($conn,$_POST['title']);
$description = mysqli_real_escape_string($conn,$_POST['description']);
$price = mysqli_real_escape_string($conn,$_POST['price']);
$address = mysqli_real_escape_string($conn,$_POST['address']);
$phone = mysqli_real_escape_string($conn,$_POST['phone']);
$email = mysqli_real_escape_string($conn,$_POST['email']);
$image = mysqli_real_escape_string($conn,$_POST['image']);
$city = mysqli_real_escape_string($conn,$_POST['city']);
$promotion = mysqli_real_escape_string($conn,$_POST['promotion']);
$ownerID = $_POST['ownerID'];
$category = mysqli_real_escape_string($conn,$_POST['category']);

$adToChange = $_SESSION['adModify'];
//modify in database
$sql = "UPDATE ads
SET title = '$Title',
description = '$description',
price = $price,
address = '$address',
phone = '$phone',
email = '$email',
image = '$image',
city = '$city',
promotion = '$promotion',
ownerID =  '$ownerID',
category = '$category'
WHERE AdID = '$adToChange'";


if(mysqli_query($conn,$sql)){
  if($_SESSION["usetype"]=="Admin"){
    header ("location: manage_users_ads.php");
    }else {
    header ("location: account.php");
    }

}
}
}//end of if statement for post method "change"
// cancel and go to manage ads (for user) or manage user ads (for Admin)
if($_SERVER["REQUEST_METHOD"] == "POST"  && isset ($_POST['cancel'])){
if($_SESSION["usetype"]=="Admin"){
header ("location: manage_users_ads.php");
}else {
header ("location: account.php");
}
}

?>

<!DOCTYPE html>
<html>

   <head>
   <link rel="stylesheet" href="styles.css">
   <?php include("bootstrap.php"); ?>
    <title>Edit Ad</title>

   </head>

   <body bgcolor = "#FFFFFF">
    	<?php include("menu.php"); ?>
      <div class = "container">
        <div class="row">
            <div class="col-sm-2" style="background-color:lavender;"></div>
            <div class="col-sm-8">
               <form action = "" method = "post" class="form-horizontal">
                  <label>Owner ID:</label>
                    <input class="form-control" type = "text" name = "ownerID" class = "box" value = '<?php echo $ownerID?>'/><br /><br />
                  <label>Title:</label>
                    <input class="form-control" type = "text" name = "title" class = "box" value = '<?php echo $Title?>'/><br/><br />
                  <label>Description:</label>
                    <input class="form-control" type = "text" name = "description" class = "box" value ='<?php echo $description?>' /><br/><br />
                  <label>price:</label>
                    <input class="form-control" type = "number" step=".05" name = "price" class = "box" value ='<?php echo $price?>'/><br /><br />
                  <label>address:</label>
                    <input class="form-control" type = "text" name = "address" class = "box" value ='<?php echo $address?>'/><br /><br />
                  <label>phone:</label>
                    <input class="form-control" type = "number" name = "phone" class = "box" value = '<?php echo $phone?>'/><br /><br />
                  <label>email:</label>
                    <input class="form-control" type = "email" name = "email" class = "box" value ='<?php echo $email?>'/><br /><br />
                  <label>image:</label>
                    <input class="form-control" type = "text" name = "image" class = "box" value ='<?php echo $image?>'/><br /><br />
                  <label>city:</label>
                    <input class="form-control" type = "text" name = "city" class = "box" value = '<?php echo $city?>'/><br /><br />
                  <label>category:</label>
                    <input class="form-control" type = "text" name = "category" class = "box" value = '<?php echo $category?>'/><br /><br />
                  <label>promotion:</label>
                    <input class="form-control" type = "text" name = "promotion" class = "box" value = '<?php echo $promotion?>'/><br /><br />

                  <input class="btn btn-default" type = "submit" name= "change" value = "Submit changes"/>
                  <input class="btn btn-default" type = "reset">
                  <input class="btn btn-default" type ="submit" name= "cancel" value="Cancel"><br />
               </form>
            </div>
            <div class="col-sm-2" style="background-color:lavender;"></div>
		</div>

      </div>

   </body>
</html>