Система за обяви

Автор: MontefuckeR

Написах система за обяви, не е много голяма. Това е първия ми цял проект писан.Знам, че кода не е от най-добрите.Сложил съм защити каквито мога…Казвайте идей,препоръки на ЛС или в коментарите!
Все пак се уча 🙂
Системата включва:
Добавяне на обяви,Преглед на всички обяви,Коментари на обявите,Оценки на обявите,Странициране,Админ панел на обявите,Контакти.

Започваме с index.php:

<?php
echo "
<a href='view.php'>vij obqvite</a>
<a href='add.php'>dobavi obqva</a>
<a href='login.php'>adminpanel</a>
<a href='contact.php'>contact</a>
";
?>

няма какво да обяснявам то е ясно.
config.php

<?php
echo "<a href='javascript:history.back()'>nazad</a><br>";
echo "<a href='$self'>nachalo</a>";
include ("function.php");
$self = $_SERVER['PHP_SELF'];
$hostname = "localhost";
$dbuser = "потребител";
$dbpass = "парола";
$dbname = "дата база";
$connect = mysql_connect($hostname, $dbuser, $dbpass)or die(mysql_error());
mysql_select_db($dbname,$connect);
?>

add.php

<?php
include ('config.php');
if(isset($_POST['izprati'])){
$ime = $_POST['ime'];
$ime = htmlspecialchars($ime);
$ime = strip_tags($ime);
$ime = get($ime);
$email = $_POST['email'];
$email = htmlspecialchars($email);
$email = strip_tags($email);
$email = get($email);
$cena = $_POST['cena'];
$cena = htmlspecialchars($cena);
$cena = strip_tags($cena);
$cena = get($cena);
$opisanie = $_POST['opisanie'];
$opisanie = htmlspecialchars($opisanie);
$opisanie = strip_tags($opisanie);
$opisanie = get($opisanie);
$gsm = $_POST['gsm'];
$gsm = htmlspecialchars($gsm);
$gsm = strip_tags($gsm);
$gsm = get($gsm);
$izberi = $_POST['izberi'];
$izberi = htmlspecialchars($izberi);
$izberi = strip_tags($izberi);
$izberi = get($izberi);
$snimka = $_POST['snimka'];
$snimka = htmlspecialchars($snimka);
$snimka = strip_tags($snimka);
$snimka = get($snimka);
$category = $_POST['category'];
$category = htmlspecialchars($category);
$category = strip_tags($category);
$category = get($category);
$vip = $_POST['vip'];
$vip = htmlspecialchars($vip);
$vip = strip_tags($vip);
$vip = get($vip);
$date = date('d-m-y g:i');
$code = "123"; //coda za vip-obqvite

if($ime== NULL){ //proverqvame dali sa prazni poletata
echo "Populnete ime!";
exit;
}
elseif($email == NULL){
echo "populnete email!";
exit;
}
elseif($opisanie==NULL){
echo "populnete opisanie!";
exit;
}
elseif($vip == $code){
$pole = "style=\'background:EEF4B0;color:D10000\'"; //ako sa vip kakvo da stane poleto
$vip = str_replace("123" , "$pole",$vip);
$zapis = mysql_query("INSERT INTO obqvi(ime,email,cena,opisanie,gsm, izberi,snimka, date, category, vip) VALUES('$ime','$email','$cena','$opisanie','$gsm','$izberi','$snimka','$date','$category','$vip')");
echo "vashata obqva e poblikuvana kato VIP!";
}
else {
$zapis = mysql_query("INSERT INTO obqvi(ime,email,cena,opisanie,gsm, izberi,snimka, date, category) VALUES('$ime','$email','$cena','$opisanie','$gsm','$izberi','$snimka','$date','$category')");
echo "Obqvata e dobavena!";
}
}
?>
<table border="1">
<tr>
<td><form action="" method="POST">
Kakvo prodavate/kopuvate?:<input type="text" name="ime"></td></tr>
<tr><td>email:<input type="text" name="email"></td></tr>
<tr><td>cena:<input type="text" name="cena"></tr></td>
<tr><td>GSM:<input type="text" name="gsm"></tr></td>
<tr><td>opisanie:<textarea name="opisanie"></textarea></tr></td>
<tr><td>snimka:<input type="text" name="snimka"></tr></td>
<tr><td>vip:<br>
<span style='font-size:9px;'>(vuvedete 123, <br>za da napravite obqvata VIP)</span>
<input type='text' name='vip'></td></tr>
<tr><td>tip:
<select name="izberi">
<option 1>kupuvam
<option 2>prodavam
</select>
</td></tr>
<tr><td>
<select name="category">
<option 1>Avto i moto
<option 2>Nedvijimi imoti
<option 3>Razni
</select>
</td></tr>
<tr><td><input type="submit" name="izprati" value="izprati"></tr></td>
</form>
</table>

view.php

<?php
include ('config.php');
echo "<br>Pokasji samo obqvi ot tip:<a href=\"$self?izberi=kupuvam\">Kupuvam<a/> <a href=\"$self?izberi=prodavam\">Prodavam</a> <a href='view.php'>vsichki obqvi</a><br>";
echo "Pod kategorii:
<div style='width:135px;height:58px;overflow: auto;'>
<a href='$self?category=razni'>razni</a><br>
<a href='$self?category=avto i moto'>avto i moto</a><br>
<a href='$self?category=nedvijimi imoti'>Nedvijimi imoti</a><br>
</div>
";
$vip = $_GET['vip'];
$izberi = $_GET['izberi'];
$izberi = htmlspecialchars($izberi);
$izberi = strip_tags($izberi);
$izberi = get($izberi);
$category = $_GET['category'];
$category = htmlspecialchars($category);
$category = strip_tags($category);
$category = get($category);

//nachalo na stranicirane
$redove = ($pageNum - 1) * $broinastranica; ;
$broinastranica = "4";
$pageNum = "1";
if(isset($_GET['page']))
{
$pageNum = $_GET['page'];
$pageNum = htmlspecialchars($pageNum);
$pageNum = strip_tags($pageNum);
$pageNum = get($pageNum);
}
$redove = ($pageNum - 1) * $broinastranica;



$maxPage = ceil($numrows/$broinastranica);

$self = $_SERVER['PHP_SELF'];
$nomeranastranici = '';

for($page = 1; $page <= $maxPage; $page++)
{
if ($page == $pageNum)
{
$nomeranastranici .= " $page ";
}
else
{
$cat = (isset($_GET["category"])) ? "&category=" . $_GET["category"] : "";
$izberi = (isset($_GET["izberi"])) ? "&izberi=" . $_GET["izberi"] : "";
$nomeranastranici .= " <a href=\"$self?page=$page$cat$izberi\">$page</a> ";
}
}


if (isset($_GET['izberi'])){ $zapisi = "SELECT * FROM obqvi WHERE izberi='$izberi' ORDER BY id DESC LIMIT $redove, $broinastranica"; }
elseif (isset($_GET['category'])){ $zapisi = "SELECT * FROM obqvi WHERE category='$category' ORDER BY id DESC LIMIT $redove, $broinastranica"; }
elseif (!isset($_GET['izberi']) and !isset($_GET['category']) ){ $zapisi = "SELECT * FROM obqvi ORDER BY vip DESC, id DESC LIMIT $redove, $broinastranica"; }
$results = mysql_query($zapisi)or die (mysql_error());
while($row = mysql_fetch_array($results)){
echo "
<TABLE $row[vip] align='center' border='1' cellpadding='2px' cellspacing='2px' width='500px'>
<TR valign=top >
<TD width=59 height=22>
$row[izberi]:
</TD>
<TD colspan=3 height=22>$row[ime]
</TD>
</TR>
<TR valign=top>
<TD width=59 height=50>
opisanie:
</TD>
<TD colspan=3>$row[opisanie]
$snimka
</TD>
</TR>
<TR valign=top>
<TD width=59 height=17>
cena:
</TD>
<TD width=44 height=17>$row[cena]
</TD>
<TD width=20 height=17>
data:</TD>
<TD width=177 height=17> $row[date]</TD>
</TD>
</TR>
<TR valign=top>
<TD width=59 height=13>email:
</TD>
<TD colspan=1 height=13>$row[email]
</TD>
<TD width=20 height=17>GSM:
</td>
<TD width=100 height=17>$row[gsm]
</td>
</TR>
<TR valign=top>
<TD colspan=2 height=22>
<a href='koment.php?id=$row[id]'>komentari</a>
<TD height=22>
<form action='vote.php?id=$row[id]' method='POST'>
<select name='vot'>
<option 1>1
<option 2>2
<option 3>3
<option 4>4
<option 5>5
</select>
<input type='submit' value='izprati' name='submit'>
</form>
</td>
<TD height=22>categoriq: $row[category]</td>
</TD>
</TR>
</table><br>";
}
// създаване на ликовете [предишна] [следваща]
// както и линковете [първа] и [последна]
if(isset($_GET['izberi'])){
$query = "SELECT COUNT(id) AS numrows FROM obqvi WHERE izberi='$izberi'";
}
elseif(isset($_GET['category'])){
$query = "SELECT COUNT(id) AS numrows FROM obqvi WHERE category='$category'";
}
elseif(!isset($_GET['izberi']) && !isset($_GET['category'])){
$query = "SELECT COUNT(id) AS numrows FROM obqvi";
}

$result = mysql_query($query) or die(mysql_error());
$row = mysql_fetch_array($result, MYSQL_ASSOC);
$numrows = $row['numrows'];


$maxPage = ceil($numrows/$broinastranica);

$self = $_SERVER['PHP_SELF'];
$nomeranastranici = '';

for($page = 1; $page <= $maxPage; $page++)
{
if ($page == $pageNum)
{
$nomeranastranici .= "[ $page ]";
}
else
{
$cat = (isset ($_GET["category"])) ? "&category=" . $_GET["category"] : "";
$izberi = (isset ($_GET["izberi"])) ? "&izberi=" . $_GET["izberi"] : "";
$nomeranastranici .= " <a href=\"$self?page=$page$cat$izberi\">$page</a> ";
}
}

if ($pageNum > 1)
{
$cat = (isset($_GET["category"])) ? "&category=" . $_GET["category"] : "";
$izberi = (isset($_GET["izberi"])) ? "&izberi=" . $_GET["izberi"] : "";
$page = $pageNum - 1;
$predishna = " <a href=\"$self?page=$page$cat$izberi\"> [<<<<<] </a> ";

$parva = " <a href=\"$self?page=1$cat$izberi\">[purva]</a> ";
}
else
{
$predishna = ' ';
$parva = ' ';
}

if ($pageNum < $maxPage)
{
$cat = (isset($_GET["category"])) ? "&category=" . $_GET["category"] : "";
$izberi = (isset($_GET["izberi"])) ? "&izberi=" . $_GET["izberi"] : "";
$page = $pageNum + 1;
$sledvashta = " <a href=\"$self?page=$page&$cat&$izberi\"> [>>>>>] </a> ";

$posledna = " <a href=\"$self?page=$maxPage&$cat&$izberi\">[posledna]</a> ";
}
else
{
$sledvashta = ' ';
$posledna = ' ';
}

// показваме
echo "<div align='center'>$parva $predishna $nomeranastranici $sledvashta $posledna</div>";
?>

login.php (в случея е админ панел)

<?php
session_start();
include ('config.php');
$username = $_POST['username'];
$username = htmlspecialchars($username);
$username = strip_tags($username);
$username = get($username);
$password = $_POST['password'];
$password = htmlspecialchars($password);
$password = strip_tags($password);
$password = get($password);
$password2 = "asd";//potrebitelsko ime
$username2 = "asd";//parola
$_SESSION['username'] = $username2;
if(isset($_SESSION['username'])){
$zapisi = ("SELECT * FROM obqvi ORDER BY id DESC");
$results = mysql_query($zapisi)or die (mysql_error());
$row = mysql_numrows($results);
while($row = mysql_fetch_array($results)){
if($username == $username2 and $password == $password2){
echo "<a href='logout.php'>izhod</a>";
echo "
<TABLE align='center' border='1' cellpadding='2px' cellspacing='2px' width='500px'>
<TR valign=top>
<TD width=19 height=22><a href='del.php?id=$row[id]'>dell</a></td>
<TD width=59 height=22>
$row[izberi]:
</TD>
<TD colspan=3 height=22>$row[ime]
</TD>
</TR>
<TR valign=top>
<TD width=59 height=50>
opisanie:
</TD>
<TD colspan=3>$row[opisanie]
<img width='100px' height='100px' src='$row[snimka]'>
</TD>
</TR>
<TR valign=top>
<TD width=59 height=17>
cena:
</TD>
<TD width=44 height=17>$row[cena]
</TD>
<TD width=20 height=17>
data:</TD>
<TD width=177 height=17> $row[date]</TD>
</TD>
</TR>
<TR valign=top>
<TD width=59 height=13>email:
</TD>
<TD colspan=0 height=13>$row[email]
</TD>
<TD width=20 height=17>GSM:
</td>
<TD width=100 height=17>$row[gsm]
</td>
<TD width=100 height=17>$row[category]
</td>
</TR>
</table><br>
<form method='post' action='edit.php?id=$row[id]'>
<input type='text' name='ime' value='$row[ime]'>
<input type='text' name='email' value='$row[email]' >
<input type='text' name='cena' value='$row[cena]'>
<input type='text' name='GSM' value='$row[gsm]'>
<textarea name='opisanie' >$row[opisanie]</textarea>
<input type='text' name='snimka' value='$row[snimka]' >
<select name='izberi'>
<option 1>kupuvam
<option 2>prodavam
</select>
<select name='category'>
<option 1>Avto i moto
<option 2>Nedvijimi imoti
<option 3>Razni
</select>
<input type='submit' name='$row[id]' value='edit' />
</form>";
}
else {
echo "greshka";
}
}
}
else {
echo "nqma dostap";
}
echo "
<form action='' method='POST'>
<input type='text' name='username'>
<input type='password' name='password'>
<input type='submit' value='submit' name='submit'>
</form>";
?>

del.php

<?php
session_start(); //startirame sesiq
include ('config.php');
$id =$_GET['id'];
$id = htmlspecialchars($id);
$id = strip_tags($id);
$id = get($id);
if(isset($_SESSION['username'])){
if($username == $username2 and $password == $password2){
mysql_query("DELETE FROM obqvi WHERE id='$id'") or die('Сайте не може да се изтрие!');
echo "iztrito";
}
else {
echo "err";
}
}
else {
echo "nqmate dostap do tazi stranica!";
}
?>

edit.php

<?php
session_start();
include ('config.php');
if(isset($_SESSION['username'])){
$ime = $_POST['ime'];
$ime = htmlspecialchars($ime);
$ime = strip_tags($ime);
$ime = get($ime);
$email = $_POST['email'];
$email = htmlspecialchars($email);
$email = strip_tags($email);
$email = get($email);
$cena = $_POST['cena'];
$cena = htmlspecialchars($cena);
$cena = strip_tags($cena);
$cena = get($cena);
$opisanie = $_POST['opisanie'];
$opisanie = htmlspecialchars($opisanie);
$opisanie = strip_tags($opisanie);
$opisanie = get($opisanie);
$gsm = $_POST['gsm'];
$gsm = htmlspecialchars($gsm);
$gsm = strip_tags($gsm);
$gsm = get($gsm);
$izberi = $_POST['izberi'];
$izberi = htmlspecialchars($izberi);
$izberi = strip_tags($izberi);
$izberi = get($izberi);
$snimka = $_POST['snimka'];
$snimka = htmlspecialchars($snimka);
$snimka = strip_tags($snimka);
$snimka = get($snimka);
$category = $_POST['category'];
$category = htmlspecialchars($category);
$category = strip_tags($category);
$category = get($category);
$id = $_GET['id'];
$id = htmlspecialchars($id);
$id = strip_tags($id);
$id = get($id);
mysql_query("UPDATE obqvi SET ime='$ime',email='$email',cena='$cena',gsm='$gsm',opisanie='$opisanie',snimka='$snimka',izberi='$izberi', category='$category' WHERE id='$id'") or die('ерр!');
echo "promeneno";
}
else {
echo "nqmate dostap do tazi stranica!";
}
?>

koment.php

<?php
include ('config.php');
if(isset($_POST['submit'])){
$ime = $_GET['id'];
$ime = htmlspecialchars($ime);
$ime = strip_tags($ime);
$ime = get($ime);
$name = $_POST['name'];
$name = htmlspecialchars($name);
$name = strip_tags($name);
$name = get($name);
$komentar = $_POST['komentar'];
$komentar = htmlspecialchars($name);
$komentar = strip_tags($name);
$komentar = get($name);
$date = date('d-m-y g:i');
if($komentar == NULL){
echo "populnete komentar";
}
else {
$zapis = mysql_query("INSERT INTO komentari(name, komentar, date, ime) VALUES('$name','$komentar','$date','$ime')")or die(mysql_error());
}
}
echo "
<form action='' method='POST'>
vasheto ime:<input type='text' name='name'><br >
komentara vi:<textarea name='komentar'></textarea>
<input type='submit' name='submit' value='izprati'>
";
$id = $_GET['id'];
$id = htmlspecialchars($id);
$id = strip_tags($id);
$id = get($id);
$broinastranica = 2;

// от коя страница да почне да показва.Може да искаме да е от втора или от последна.

$pageNum = 1;

// ако има получени данни $_GET['page'] ще покаже страницата с номер $_GET['page']

if(isset($_GET['page']))
{
$pageNum = $_GET['page'];
$pageNum = htmlspecialchars($pageNum);
$pageNum = strip_tags($pageNum);
$pageNum = get($pageNum);
}

//тука определяме кои редове ще се показват - примерно ако $_GET['page']=2
// ще покаже от 20 до 40-ти ред.
$redove = ($pageNum - 1) * $broinastranica;
//заявката ще върне само посочените редове - примерно от 20 до 40 в зависимост от $_GET['page']
$query = " SELECT * FROM komentari WHERE ime='$id' order by id DESC " .
" LIMIT $redove, $broinastranica";
$result = mysql_query($query) or die('Error, query failed');

echo "<table border=1>";
// print-ваме посочените редове в таблица.
while($row = mysql_fetch_array($result))
{
echo '
<tr>
<td>ime:</td>
<td>'.$row['name'].'</td>
</tr>
<tr>
<td valign="top">komentar:</td>
<td width="200px" height="200px">'.$row['komentar'].'</td>
</tr>
';
}

echo"</table>";


// проверяваме таблицата колко редове има
$query = "SELECT COUNT(ime) AS numrows FROM komentari WHERE ime='$id'";
$result = mysql_query($query) or die('Error, query failed');
$row = mysql_fetch_array($result, MYSQL_ASSOC);
$numrows = $row['numrows'];


$maxPage = ceil($numrows/$broinastranica);

$self = $_SERVER['PHP_SELF'];
$nomeranastranici = '';

for($page = 1; $page <= $maxPage; $page++)
{
if ($page == $pageNum)
{
$nomeranastranici .= " $page ";
}
else
{
$nomeranastranici .= " <a href=\"$self?id=".$id."&page=$page\">$page</a> ";
}
}



// създаване на ликовете [предишна] [следваща]
// както и линковете [първа] и [последна]


if ($pageNum > 1)
{
$page = $pageNum - 1;
$predishna = " <a href=\"$self?id=".$id."&page=$page\"> [<<<<<] </a> ";

$parva = " <a href=\"$self?id=".$id."&page=1\">[първа]</a> ";
}
else
{
$predishna = ' ';
$parva = ' ';
}

if ($pageNum < $maxPage)
{
$page = $pageNum + 1;
$sledvashta = " <a href=\"$self?id=".$id."&page=$page\"> [>>>>>] </a> ";

$posledna = " <a href=\"$self?id=".$id."&page=$maxPage\">[последна]</a> ";
}
else
{
$sledvashta = ' ';
$posledna = ' ';
}

// показваме
echo $parva . $predishna . $nomeranastranici . $sledvashta . $posledna;

?>

logout.php

<?php
session_start(); //startirame sesiq
session_destroy(); //izlizame ot neq
header("location: index.php "); //preprashtane kum index-a
?>

function.php

<?php
function get($str)
{
$from = array(";", "*", "DELETE", "delete", "SELECT", "select", "INSERT", "insert", "UPDATE", "update", "WHERE", "where");
$to = array("","","","","","","","","","","");
$url = str_replace($from, $to, $str);
$url = strip_tags($url);
return $url;
}
?>

vote.php

<?php
include ('config.php');
if(isset($_POST['submit'])){
$vot = $_POST['vot'];
$vot = htmlspecialchars($vot);
$vot = strip_tags($vot);
$vot = get($vot);
$date = date('d-m-y g:i');
$obqva_id = $_GET['id'];
$obqva_id = htmlspecialchars($obqva_id);
$obqva_id = strip_tags($obqva_id);
$obqva_id = get($obqva_id);
$ip = $_SERVER['REMOTE_ADDR'];
$zapis = mysql_query("INSERT INTO vote(vot, date, obqva_id,ip) VALUES('$vot','$date','$obqva_id','$ip')");
}
$zapis = ("SELECT * FROM vote WHERE ip='$ip' AND obqva_id='$id' LIMIT 1")or die(mysql_error());
$results = mysql_query($zapis);
$row = mysql_numrows($results);
while($row = mysql_fetch_array($results)){
}
echo "vashiq glas e priet!";
?>

contact.php

<?php
session_start();
include ('config.php');
if(isset($_POST['submit'])){
$to = "mail3@abv.bg";
$subject = $_POST['subject'];
$subject = htmlspecialchars($subject);
$subject = strip_tags($subject);
$subject = get($subject);
$msg = $_POST['msg'];
$msg = htmlspecialchars($msg);
$msg = strip_tags($msg);
$msg = get($msg);
$from = $_POST['from'];
$subject = htmlspecialchars($from);
$subject = strip_tags($from);
$subject = get($from);
$proverka2 = $_POST['proverka'];
$proverka2 = htmlspecialchars($proverka2);
$proverka2 = strip_tags($proverka2);
$proverka2 = get($proverka2);
if ($proverka2 == $_SESSION['prov']){
$ok = mail($to,$title,$msg, "From: $from");
}
elseif ($proverka2 == NULL){
echo "ne ste vuveli chislo za proverka";
}
elseif ($proverka2 != $_SESSION['prov']){
echo " vasheto chislo e razlichno";
}
}
else {
$proverka = rand(2,300);
$_SESSION['prov']=$proverka;
echo "
<form action='' method='POST'>
adresa vi<input type='text' name='from'><br>
otnosno<input type='text' name='subject'><br>
msg<textarea name='msg'></textarea><br>
vuvedete chisloto ".$proverka." <br>
<input type='text' name='proverka'><br>
<input type='submit' value='izprati' name='submit'><br>
";
}
?>

и ето таблиците в бд-то:

CREATE TABLE obqvi (
id int(8) not null auto_increment ,
ime varchar(120) not null,
email varchar(130) not null,
cena varchar(140) not null,
opisanie varchar(500) not null,
gsm varchar(80) not null,
izberi varchar(50) not null,
snimka varchar(200) not null,
date varchar(100) not null ,
category varchar(200) not null,
vip varchar(300) not null,
PRIMARY KEY (id)
);


CREATE TABLE komentari (
id int(8) not null auto_increment,
name varchar(120) not null,
komentar varchar(500) not null,
date varchar(80) not null,
ime varchar(120) not null,
PRIMARY KEY (id)
);

CREATE TABLE vote (
id int(8) not null auto_increment,
date varchar(100) not null,
vot varchar(20) not null,
obqva_id int(8) not null,
ip varchar(200) not null,
PRIMARY KEY (id)
);