post_offer_buy1.php

通达OA部分源代码

<?php
include_once'logincheck.php';
include_once("myconnect.php");

function RTESafe($strText) {
	//returns safe code for preloading in the RTE
	$tmpString = trim($strText);
	
	//convert all types of single quotes
	$tmpString = str_replace(chr(145), chr(39), $tmpString);
	$tmpString = str_replace(chr(146), chr(39), $tmpString);
	$tmpString = str_replace("'", "&#39;", $tmpString);
	
	//convert all types of double quotes
	$tmpString = str_replace(chr(147), chr(34), $tmpString);
	$tmpString = str_replace(chr(148), chr(34), $tmpString);
//	$tmpString = str_replace("\"", "\"", $tmpString);
	
	//replace carriage returns & line feeds
	$tmpString = str_replace(chr(10), " ", $tmpString);
	$tmpString = str_replace(chr(13), " ", $tmpString);
	
	return $tmpString;
}


$errcnt=0;
if(count($_POST)<>0)		//IF SOME FORM WAS POSTED DO VALIDATION
{
/////////---getting config---------
	$sbq_con='select * from sbbleads_config where sb_id=1';
	$sbrow_con=mysql_fetch_array(mysql_query($sbq_con));
	
	$sbq_gro='select * from sbbleads_groups where sb_memtype='.$_SESSION["sbbleads_memtype"];
	$sbrow_gro=mysql_fetch_array(mysql_query($sbq_gro));

/////////--------------getting information bout user's privious postings
	$sbq_off="select * from sbbleads_offers_buy where sb_uid=".$_SESSION["sbbleads_userid"];
	$sbbuy_count=mysql_num_rows(mysql_query($sbq_off));
//////////////////////////////////---------------------------

	if( $sbbuy_count >= $sbrow_gro["sb_buy_cnt"] ) 
	{
		header("Location: userhome.php?msg=".urlencode("You have already posted maximum allowed Buy offers"));
		die();
	}	
////////////////////--------------------

	$sb_cat_list=$_REQUEST["category"];
	$cid_list=$_REQUEST["cid"];
	
	$cat=explode(",",$_REQUEST["cid"]);
//	$cat_name=explode(",",$_REQUEST["category"]);
	
	$sb_title=$_REQUEST["sb_title"];
	$sb_description=$_REQUEST["sb_description"];
	$sb_quantity=$_REQUEST["sb_quantity"];
	$sb_keywords=$_REQUEST["sb_keywords"];
	$key=explode(",",$sb_keywords);

	$sb_price_cur_id=$_REQUEST["sb_price_cur_id"];
	$sb_price=$_REQUEST["sb_price"];

		if( $cid_list == '' )
		{
			$errs[$errcnt]="Atleast one Category must be provided";
			$errcnt++;
		}
		elseif(count($cat) > $sbrow_gro["sb_cat_cnt"])
		{
			$errs[$errcnt]="Too many Categories provided";
			$errcnt++;
		}
		
		
		if ( strlen(trim($sb_title)) == 0 )
		{
			$errs[$errcnt]="Title must be provided";
			$errcnt++;
		}
		elseif(preg_match ("/[<>&]/", $sb_title))
		{
			$errs[$errcnt]="Title can not have any special character i.e. & < >";
			$errcnt++;
		}

		if ( strlen(trim($sb_description)) == 0 )
		{
			$errs[$errcnt]="Description must be provided";
			$errcnt++;
		}
		elseif ( strlen(strip_tags($sb_description)) > $sbrow_con['sb_description_length'] )
		{
			$errs[$errcnt]="Description length must not exceed ".$sbrow_con['sb_description_length']." characters";
			$errcnt++;
		}
		
		if ( !is_numeric($sb_quantity) || ($sb_quantity <= 0) )
		{
			$errs[$errcnt]="Quantity must be non-zero positive integer";
			$errcnt++;
		}
		
		if ( strlen(trim($sb_keywords)) == 0 )
		{
			$errs[$errcnt]="Keywords must be provided";
			$errcnt++;
		}
		elseif(preg_match ("/[<>&]/", $sb_keywords))
		{
			$errs[$errcnt]="Keywords can not have any special character i.e. & < >";
			$errcnt++;
		}
		elseif(count($key) > $sbrow_gro["sb_keyword_cnt"])
		{
			$errs[$errcnt]="Too many keywords provided";
			$errcnt++;
		}
	
		if ( !is_numeric($sb_price_cur_id) || ($sb_price_cur_id == 0) )
		{
			$errs[$errcnt]="Price currency must be selected";
			$errcnt++;
		}

		if ( !is_numeric($sb_price) || ($sb_price <= 0) )
		{
			$errs[$errcnt]="Price must be non-zero positive number";
			$errcnt++;
		}
		
			
		if($errcnt==0)
		{
			if(!get_magic_quotes_gpc())
			{
				$sb_title=str_replace("$","\$",addslashes($sb_title));
				$sb_description=str_replace("$","\$",addslashes($sb_description));
				$sb_quantity=str_replace("$","\$",addslashes($sb_quantity));
				$sb_keywords=str_replace("$","\$",addslashes($sb_keywords));
			}
			else
			{
				$sb_offer_type=str_replace("$","\$",$sb_offer_type);
				$sb_title=str_replace("$","\$",$sb_title);
				$sb_description=str_replace("$","\$",$sb_description);
				$sb_quantity=str_replace("$","\$",$sb_quantity);
				$sb_keywords=str_replace("$","\$",$sb_keywords);
			}
			$sb_price_cur_id=(int)$sb_price_cur_id;
			$sb_price=$sb_price;
			
			$sb_postedon=date("YmdHis",time());
			$sb_approved='yes';
			$sb_uid=$_SESSION["sbbleads_userid"];
		//	$sb_expireson=;
//		$sbq_con='select * from sbbleads_config where sb_id=1';
//		$sbrow_con=mysql_fetch_array(mysql_query($sbq_con));
		if($sbrow_con['sb_approval_type_offer']=='auto')
		{
			$sb_new='no';
			$sb_approved='yes';
			$sb_msg='Your buy offer has been posted';
		}
		else
		{
			$sb_new='yes';
			$sb_approved='no';
			$sb_msg='Your buy offer has been sent for admin approval';
		}
		
		$sbqi_off="Insert into `sbbleads_offers_buy` (sb_uid, sb_title, sb_description, sb_quantity, sb_postedon, sb_keywords, sb_price_cur_id, sb_price, sb_approved, sb_new) values ($sb_uid, '$sb_title', '$sb_description', $sb_quantity, $sb_postedon, '$sb_keywords', $sb_price_cur_id, $sb_price, '$sb_approved', '$sb_new')";
	//	die($sbqi_off);
		mysql_query($sbqi_off);
		if(mysql_affected_rows()>0)
		{
///-adding to categories
			$sbq_off="select max(sb_id) as max_id from sbbleads_offers_buy where 1";
			$sbrow_off=mysql_fetch_array(mysql_query($sbq_off));
			$sb_offer_id=$sbrow_off["max_id"];
			foreach($cat as $sb_value)
			{
				$sbq_off_cat="select * from sbbleads_offer_cats_buy where sb_offer_id=$sb_offer_id and sb_cid=$sb_value";
				//echo $sbq_off_cat;
//				$sbrs_off_cat=
				if( mysql_num_rows(mysql_query($sbq_off_cat)) > 0 )
					continue;		//skips if record already exists
				$sbqi_off_cat="insert into sbbleads_offer_cats_buy (sb_offer_id, sb_cid) values ($sb_offer_id, $sb_value)";
				mysql_query($sbqi_off_cat);
			}
			header ("Location: manage_offers_buy.php?msg=".urlencode($sb_msg));
			die();
		}// if inserted
		else
		{
			header("Location: userhome.php?msg=".urlencode("Unable to post buy offer, please try again"));
			die();
		}
		}// if no errors

}// if form posted
else
{
/////////---getting config---------
	$sbq_con='select * from sbbleads_config where sb_id=1';
	$sbrow_con=mysql_fetch_array(mysql_query($sbq_con));
	
	$sbq_gro='select * from sbbleads_groups where sb_memtype='.$_SESSION["sbbleads_memtype"];
	$sbrow_gro=mysql_fetch_array(mysql_query($sbq_gro));

/////////--------------getting information bout user's privious postings
	$sbq_off="select * from sbbleads_offers_buy where sb_uid=".$_SESSION["sbbleads_userid"];
	$sbbuy_count=mysql_num_rows(mysql_query($sbq_off));
//////////////////////////////////---------------------------

	if( $sbbuy_count >= $sbrow_gro["sb_buy_cnt"] ) 
	{
		header("Location: manage_offers_buy.php?msg=".urlencode("You have already posted maximum allowed buy offers"));
		die();
	}	
	
	$cid_list='';
	$sb_cat_list='';
	$sb_title='';
	$sb_description='';
	$sb_quantity='';
	$sb_keywords='';
	$sb_price_cur_id='';
	$sb_price='';
}

function main ()
{
global $sbbuy_count, $sbrow_con, $sbrow_gro, $errs, $errcnt, $cid_list, $sb_cat_list, $sb_title, $sb_description, $sb_quantity, $sb_keywords, $sb_price_cur_id, $sb_price;

$showform="";

if  (count($_POST)>0)
{

if ( $errcnt <> 0 )
{
?>
<table width="90%" border="0" align="center" cellpadding="2" cellspacing="0" class="errorstyle">
  <tr> 
    <td colspan="2"><strong>&nbsp;Your Request cannot be processed due to following 
      reasons</strong></td>
  </tr>
  <tr height="10"> 
    <td colspan="2"></td>
  </tr>
  <?

for ($i=0;$i<$errcnt;$i++)
{
?>
  <tr valign="top"> 
    <td width="6%">&nbsp;<?php echo $i+1;?></td>
    <td width="94%"><?php echo  $errs[$i]; ?></td>
  </tr>
  <?
}
?>
</table>

<?

}

}

if ($showform<>"No")
{
?>
<script language="JavaScript" type="text/javascript" src="richtext.js"></script>
<script language="JavaScript">
					function add_category()
					{
					if(document.form123.cats.value!=0)
					{
					var id=document.form123.cats.selectedIndex;
					if(document.form123.category.value=="")
					{
					document.form123.cid.value=document.form123.cats.value;
					document.form123.category.value=document.form123.cats.options[id].text;
					document.form123.category.focus();
					document.form123.cats.selectedIndex=0;