<?php

    /*
    myPHP Guestbook
    Copyright (C) 2003 - 2006  Claudio Pose
    myPHP Guestbook is a open source project of Networkarea.ch

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    */

    
    session_start();

    include("config.inc.php");
    include("functions.inc.php");
    connect();
    $count_entries = "";
    include("lang.inc.php");

    $sql_properties = mysql_query("SELECT
                                       admin_email,
                                       antiflood_ban,
                                       bbcode,
                                       captcha,
                                       check_email,
                                       check_homepage,
                                       check_icq,
                                       deactivate_html,
                                       default_style,
                                       default_template,
                                       entry_length_limit,
                                       entry_length_maximum,
                                       entry_length_minimum,
                                       guestbook_status,
                                       guestbook_title,
                                       max_word_length,
                                       notification_entries,
                                       release_entries,
                                       show_ip,
                                       smilies,
                                       statistic,
                                       statistic_ban,
                                       thanks_email
                                   FROM
                                       ".$table."_properties");

    $properties    = mysql_fetch_assoc($sql_properties);
    $default_style = $properties['default_style'];

    if ($properties['statistic']) {
        include("stats.inc.php");
    }

    $sql_template = mysql_query("SELECT
                                     bgcolor,
                                     bgimage,
                                     border,
                                     cellpadding,
                                     cellspacing,
                                     html,
                                     image_email,
                                     image_homepage,
                                     tablealign,
                                     tablewidth,
                                     tdcolor,
                                     td2color
                                 FROM
                                     ".$table."_template
                                 WHERE
                                     id='".$properties['default_template']."'");

    $template = mysql_fetch_assoc($sql_template);

    if (isset($_POST['send']) OR isset($_POST['preview'])) {
        if (isset($_POST['save_settings']) AND $_POST['save_settings'] == 1) {
            $life_time = time() + 3600;
            setcookie("name", $_POST['name'], $life_time);
            setcookie("email", $_POST['email'], $life_time);
            setcookie("homepage", $_POST['homepage'], $life_time);
            setcookie("icq", $_POST['icq'], $life_time);
            setcookie("save_settings", 1, $life_time);
        } else {
            setcookie("name");
            setcookie("email");
            setcookie("homepage");
            setcookie("icq");
            setcookie("save_settings");
        }
    }

    echo "<?xml version=\"1.0\" encoding=\"".$encoding."\" ?>
    <!DOCTYPE html
    PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\"
    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">
    <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"".$lang_short."\" lang=\"".$lang_short."\">
    <head>
    <style type=\"text/css\">
    <!-- ";

    getStyle();

    echo " //-->
    </style>
    <script type=\"text/javascript\" src=\"functions.js\"></script>
    <title>".$properties['guestbook_title']."</title>
    </head>";

    if ($template['bgimage'] == "") {
        echo "<body bgcolor=\"".$template['bgcolor']."\" onload=\"NewWindow\"><div>";
    }

    if ($template['bgimage'] != "") {
        echo "<body background=\"".$template['bgimage']."\" onload=\"NewWindow\"><div>";
    }

    if ($properties['guestbook_status']) {
        if (isset($_POST['send']) OR isset($_POST['preview'])) {
            $error_msg = "";
	    
	    if ($_POST['anti_spam'] !=no)
		$error_msg .="<b> You did not state that you are no spammer! You have to...</b><br>";
    
            if ($_POST['name'] == "") {
                $error_msg .= "<b>- ".$ms[3]."</b><br />";
            }

            if ($_POST['text'] == "") {
                $error_msg .= "<b>- ".$ms[4]."</b><br />";
            }

            if ($properties['check_email'] AND !checkMail($_POST['email'])) {
                $error_msg .= "<b>- ".$ms[5]."</b><br />";
            }

            if ($properties['check_homepage']) {
                if ($_POST['homepage'] == "" OR $_POST['homepage'] == "http://") {
                    $error_msg .= "<b>- ".$ms[24]."</b><br />";
                } else if (!checkHomepage($_POST['homepage'])){
                    $error_msg .= "<b>- ".$ms[217]."</b><br />";
                }
            }

            if ($properties['check_icq']) {
                if (!preg_match("/^[0-9]*$/is", $_POST['icq']) OR $_POST['icq'] == "") {
                    $error_msg .= "<b>- ".$ms[208]."</b><br />";
                }
            }

            if (isset($_POST['icq']) AND $_POST['icq'] != "") {
                if (!preg_match("/^[0-9]*$/is", $_POST['icq'])) {
                    $error_msg .= "<b>- ".$ms[208]."</b><br />";
                }
            }

            if ($properties['entry_length_limit']) {
                $text_length = strlen($_POST['text']);

                if ($text_length > $properties['entry_length_maximum']) {
                    $error_msg .= "<b>- ".$ms[187]." ".$properties['entry_length_maximum']."</b><br />";
                }

                if ($text_length < $properties['entry_length_minimum']) {
                    $error_msg .= "<b>- ".$ms[188]." ".$properties['entry_length_minimum']."</b><br />";
                }
            }

            if (extension_loaded("gd") AND $properties['captcha'] == 1 AND isset($_POST['send'])) {
                if ($_POST['captcha'] == "") {
                    $error_msg .= "<b>- ".$ms[223]."</b><br />";
                } else {
                    if (strtoupper($_POST['captcha']) != $_SESSION['captcha']) {
                        $error_msg .= "<b>- ".$ms[224]."</b><br />";
                    }
                }
            }

            if (!$error_msg == "") {
                echo "".$error_msg."<br />";
            } else {
                if (isset($_POST['send'])) {
                    $_POST['email']    = mysql_escape_string($_POST['email']);
                    $_POST['homepage'] = mysql_escape_string($_POST['homepage']);
                    $_POST['icq']      = mysql_escape_string($_POST['icq']);
                    $_POST['name']     = mysql_escape_string($_POST['name']);
                    $_POST['text']     = mysql_escape_string($_POST['text']);

                    $time     = time();
                    $old_time = $time-$properties['antiflood_ban'];

                    mysql_query("DELETE FROM
                                     ".$table."_ip_ban
                                 WHERE
                                     time <= '$old_time' AND type='entry'");

                    $sql_select_ip = mysql_query("SELECT
                                                      ip
                                                  FROM
                                                      ".$table."_ip_ban
                                                  WHERE
                                                      ip='".$_SERVER['REMOTE_ADDR']."' AND type='entry'");

                    $select_ip = mysql_num_rows($sql_select_ip);

                    if ($select_ip > 0) {
                        echo "<b>".$ms[15]."</b>";
                    } else {
                        mysql_query("INSERT INTO
                                         ".$table."_ip_ban (ip, time, type)
                                     VALUES
                                         ('".$_SERVER['REMOTE_ADDR']."',
                                          '$time',
                                          'entry')");

                        mt_srand((double)microtime()*1000000);
                        $activation_code     = mt_rand(1000000,9999999);
                        $activation_hashcode = md5($activation_code);

                        if ($properties['notification_entries'] == 1 OR $properties['thanks_email'] == 1) {
                            $header  = "MIME-Version: 1.0\n";
                            $header .= "Content-type: text/plain; charset=iso-8859-1\n";
                            $header .= "Content-Transfer-Encoding: 8bit\n";
                            $header .= "X-Mailer: PHP\n";
                            $header .= "From: \"".$properties['guestbook_title']."\" <".$properties['admin_email'].">\n";

                            if ($properties['notification_entries'] == 1) {
                                if ($properties['release_entries']) {
                                    $release_text = "\n\n".$ms['222']."\n".$url."/admin/admin.php?action=activate_entry&code=".$activation_hashcode."";
                                } else {
                                    $release_text = "";
                                }

                                mail($properties['admin_email'], $ms['7'], "".$ms['8']."\n\n".$ms['9']." ".$_POST['name']."\n".$ms['10']." ".$_POST['email']."\n".$ms['11']." ".$_POST['homepage']."\nICQ: ".$_POST['icq']."\n\n".$ms['12']."\n".$_POST['text']."\n".$release_text."", $header);
                            }

                            if ($properties['thanks_email'] == 1) {
                                mail($_POST['email'], $ms['220'], $ms['221'], $header);
                            }
                        }
			
                        $sql_insert_entry = mysql_query("INSERT INTO
                                                             ".$table."_entries (activation_code, date, email, homepage, icq, id, ip, name, status, text, time)
                                                         VALUES
                                                             ('$activation_hashcode',
                                                              '".date("d.m.Y")."',
                                                              '".$_POST['email']."',
                                                              '".$_POST['homepage']."',
                                                              '".$_POST['icq']."',
                                                              '',
                                                              '".$_SERVER['REMOTE_ADDR']."',
                                                              '".$_POST['name']."',
                                                              '0',
                                                              '".$_POST['text']."',
                                                              '".date("H:i")."')");

                        if ($sql_insert_entry AND !$properties['release_entries']) {
                            echo "<meta http-equiv=\"Refresh\" content=\"0; url=".$url."/index.html";

                            if (isset($get_lang)) {
                                echo "?lang=".$_GET['lang']."";
                            }

                            echo "\">";
                        } elseif ($properties['release_entries']) {
                            echo "<meta http-equiv=\"Refresh\" content=\"2; url=".$url."/index.html";

                            if (isset($get_lang)) {
                                echo "?lang=".$_GET['lang']."";
                            }

                            echo "\"><b>".$ms['13']."</b>";
                        } else {
                            echo "<b>".$ms[14]."</b>";
                        }
                    }
                }

                if (isset($_POST['preview'])) {
                    $text = $_POST['text'];

                    if ($properties['deactivate_html']) {
                        $text = htmlentities($text);
                    }

                    $_POST['email']    = htmlentities($_POST['email']);
                    $_POST['email']    = stripslashes($_POST['email']);
                    $_POST['email']    = strip_tags($_POST['email']);
                    $_POST['homepage'] = htmlentities($_POST['homepage']);
                    $_POST['homepage'] = stripslashes($_POST['homepage']);
                    $_POST['homepage'] = strip_tags($_POST['homepage']);
                    $_POST['icq']      = htmlentities($_POST['icq']);
                    $_POST['icq']      = stripslashes($_POST['icq']);
                    $_POST['icq']      = strip_tags($_POST['icq']);
                    $_POST['name']     = htmlentities($_POST['name']);
                    $_POST['name']     = stripslashes($_POST['name']);
                    $_POST['name']     = strip_tags($_POST['name']);
                    $text              = badwords($text);
                    $text              = shortWords($text, $properties['max_word_length']);
                    $text              = nl2br($text);
                    $text              = stripslashes($text);

                    if ($properties['bbcode']) {
                        $text = bbcode($text);
                    }

                    if ($properties['smilies']) {
                        $text = smilies($text);
                    }

                    if (isset($properties['release_entries']) AND $properties['release_entries'] == 1) {
                        $sql_count_entries = mysql_query("SELECT
                                                              id
                                                          FROM
                                                              ".$table."_entries
                                                          WHERE
                                                              status='1'");
                    } else {
                        $sql_count_entries = mysql_query("SELECT
                                                              id
                                                          FROM
                                                              ".$table."_entries");
                    }

                    $count_entries = mysql_num_rows($sql_count_entries);
                    $count_entries = $count_entries+1;
                    $template_data = $template['html'];
                    $template_data = str_replace("<\$border\$>", $template['border'], $template_data);
                    $template_data = str_replace("<\$cellpadding\$>", $template['cellpadding'], $template_data);
                    $template_data = str_replace("<\$cellspacing\$>", $template['cellspacing'], $template_data);
                    $template_data = str_replace("<\$comment\$>", "", $template_data);
                    $template_data = str_replace("<\$date\$>", date("d.m.Y"), $template_data);
                    $template_data = str_replace("<\$id\$>", $count_entries, $template_data);
                    $template_data = str_replace("<\$name\$>", $_POST['name'], $template_data);
                    $template_data = str_replace("<\$tablealign\$>", $template['tablealign'], $template_data);
                    $template_data = str_replace("<\$tablewidth\$>", $template['tablewidth'], $template_data);
                    $template_data = str_replace("<\$tdcolor\$>", $template['tdcolor'], $template_data);
                    $template_data = str_replace("<\$td2color\$>", $template['td2color'], $template_data);
                    $template_data = str_replace("<\$text\$>", $text, $template_data);
                    $template_data = str_replace("<\$time\$>", date("H:i"), $template_data);

                    if ($properties['show_ip']) {
                        $template_data = str_replace("<\$ip\$>", "IP: ".$_SERVER['REMOTE_ADDR']."<br />", $template_data);
                    } else {
                        $template_data = str_replace("<\$ip\$>", "", $template_data);
                    }

                    if ($_POST['email'] == "") {
                        $template_data = str_replace("<\$email\$>", "", $template_data);
                        $template_data = str_replace("<\$email_icon\$>", "", $template_data);
                    } else {
                        $template_data = str_replace("<\$email\$>", "<a href=\"mailto:".$_POST['email']."\" title=\"".$_POST['email']."\">".$_POST['email']."</a>", $template_data);
                        $template_data = str_replace("<\$email_icon\$>", "<a href=\"mailto:".$_POST['email']."\"><img src=\"".$url."/images/icons/email/".$template['image_email']."\" border=\"0\" alt=\"".$_POST['email']."\" /></a>", $template_data);
                    }

                    if ($_POST['homepage'] == "" OR $_POST['homepage'] == "http://") {
                        $template_data = str_replace("<\$homepage\$>", "", $template_data);
                        $template_data = str_replace("<\$homepage_icon\$>", "", $template_data);
                    } else {
                        $template_data = str_replace("<\$homepage_icon\$>", "<a href=\"".$_POST['homepage']."\" target=\"_blank\"><img src=\"".$url."/images/icons/homepage/".$template['image_homepage']."\" border=\"0\" alt=\"".$_POST['homepage']."\" /></a>", $template_data);
                        $template_data = str_replace("<\$homepage\$>", "<a href=\"".$_POST['homepage']."\" title=\"".$_POST['homepage']."\">".$_POST['homepage']."</a>", $template_data);
                    }

                    if ($_POST['icq'] == 0) {
                        $template_data = str_replace("<\$icq\$>", "", $template_data);
                        $template_data = str_replace("<\$icq_icon\$>", "", $template_data);
                    } else {
                        $template_data = str_replace("<\$icq\$>", "<a href=\"http://web.icq.com/whitepages/about_me?Uin=".$_POST['icq']."\" target=\"_blank\">".$_POST['icq']."</a>", $template_data);
                        $template_data = str_replace("<\$icq_icon\$>", "<a href=\"http://web.icq.com/whitepages/about_me?Uin=".$_POST['icq']."\" target=\"_blank\"><img src=\"http://wwp.icq.com/scripts/online.dll?icq=".$_POST['icq']."&img=5\" border=\"0\" alt=\"".$_POST['icq']."\" /></a>", $template_data);
                    }

                    echo "<div align=\"".$template['tablealign']."\">
                    <br /><br /><br /><br />
                    ".$template_data."
                    </div>";
                }
            }
        }

        echo "<br /><br /><br /> <br /><br />
        <form action=\"".$url."/insert.php";

        if (isset($get_lang)) {
            echo "?lang=".$_GET['lang']."";
        }

        echo "\" method=\"post\">
        <table width=\"490\" align=\"".$template['tablealign']."\" border=\"0\" cellspacing=\"0\" cellpadding=\"1\" class=\"guestbook_table2\">
        <tr>
        <td width=\"69\" align=\"left\">".$ms[9]."*</td><td width=\"200\" align=\"left\"><input type=\"text\" name=\"name\" size=\"28\" maxlength=\"27\" value=\"";

        if (isset($_COOKIE['name']) AND $_COOKIE['name'] != "") {
            echo "".$_COOKIE['name']."";
        } elseif (isset($_POST['name']) AND $_POST['name'] != "") {
            echo "".$_POST['name']."";
        }

        echo "\" tabindex=\"1\" /></td>
        <td width=\"150\" rowspan=\"5\"><table width=\"109\" border=\"0\" cellspacing=\"0\" cellpadding=\"2\" class=\"guestbook_table2\">";

        if ($properties['bbcode']) {
            echo "<tr>
            <td colspan=\"6\" align=\"center\">BBCodes:</td>
            </tr>
            <tr>
            <td colspan=\"6\" align=\"center\"><b>Text</b> = [b]Text[/b]</td>
            </tr>
            <tr>
            <td colspan=\"6\" align=\"center\"><i>Text</i> = [i]Text[/i]</td>
            </tr>
            <tr>
            <td colspan=\"6\" align=\"center\"><u>Text</u> = [u]Text[/u]</td>
            </tr>
            <tr>
            <td colspan=\"6\" align=\"center\"><b><a href=\"javascript:NewWindow('".$url."/bbcodes.php";

            if (isset($get_lang)) {
                echo "?lang=".$_GET['lang']."";
            }

            echo "','BBCodes','260','495','custom','front');\">".$ms[19]."</a></b></td>
            </tr>
            <tr>
            <td colspan=\"6\">&nbsp;</td>
            </tr>";
        }

        if ($properties['smilies']) {
            $sql_smilies_count = mysql_query("SELECT
                                                  id
                                              FROM
                                                  ".$table."_smilies");

            $count_smilies = mysql_num_rows($sql_smilies_count);

            if ($count_smilies > 0) {
                echo "<tr>
                <td colspan=\"6\" align=\"center\">".$ms[46].":</td>
                </tr>
                <tr>";
            }

            $sql_smilies = mysql_query("SELECT
                                            bbcode,
                                            filename,
                                            height,
                                            name,
                                            width
                                        FROM
                                            ".$table."_smilies
                                        LIMIT
                                            0,5");

            while ($smilies = mysql_fetch_assoc($sql_smilies)) {
                echo "<td align=\"center\"><img src=\"".$url."/images/smilies/".$smilies['filename']."\" width=\"".$smilies['width']."\" height=\"".$smilies['height']."\" alt=\"".$smilies['name']."\" onclick=\"document.getElementById('text').value += '".$smilies['bbcode']."'\" /></td>";
            }

            if ($count_smilies > 0) {
                echo "</tr><tr>";
            }

            $sql_smilies = mysql_query("SELECT
                                            bbcode,
                                            filename,
                                            height,
                                            name,
                                            width
                                        FROM
                                            ".$table."_smilies
                                        LIMIT
                                            5,5");

            while ($smilies = mysql_fetch_assoc($sql_smilies)) {
                echo "<td align=\"center\"><img src=\"".$url."/images/smilies/".$smilies['filename']."\" width=\"".$smilies['width']."\" height=\"".$smilies['height']."\" alt=\"".$smilies['name']."\" onclick=\"document.getElementById('text').value += '".$smilies['bbcode']."'\" /></td>";
            }

            if ($count_smilies > 0) {
                echo "</tr><tr>";
            }


            $sql_smilies = mysql_query("SELECT
                                            bbcode,
                                            filename,
                                            height,
                                            name,
                                            width
                                        FROM
                                            ".$table."_smilies
                                        LIMIT
                                            10,5");

            while ($smilies = mysql_fetch_assoc($sql_smilies)) {
                echo "<td align=\"center\"><img src=\"".$url."/images/smilies/".$smilies['filename']."\" width=\"".$smilies['width']."\" height=\"".$smilies['height']."\" alt=\"".$smilies['name']."\" onclick=\"document.getElementById('text').value += '".$smilies['bbcode']."'\" /></td>";
            }

            if ($count_smilies >= 10) {
                echo "</tr>";
            }

            if ($count_smilies > 15) {
                echo "<tr>
                <td colspan=\"6\" align=\"center\"><b><a href=\"javascript:NewWindow('".$url."/smilies.php";

                if (isset($get_lang)) {
                    echo "?lang=".$_GET['lang']."";
                }

                echo "','Smilies','215','200','custom','front');\">".$ms[19]."</a></b></td>
                </tr>";
            }
        }

        echo "</table>
        </td>
        </tr>
        <tr>
        <td align=\"left\">".$ms[10]."";

        if (isset($properties['check_email']) AND $properties['check_email'] == 1) {
            echo "*";
        }

        echo "</td><td align=\"left\"><input type=\"text\" name=\"email\" size=\"28\" maxlength=\"50\" value=\"";

        if (isset($_COOKIE['email']) AND $_COOKIE['email'] != "") {
            echo "".$_COOKIE['email']."";
        } elseif (isset($_POST['email']) AND $_POST['email'] != "") {
            echo "".$_POST['email']."";
        }

        echo"\" tabindex=\"2\" /></td>
        </tr>
        <tr>
        <td align=\"left\">".$ms[11]."";

        if (isset($properties['check_homepage']) AND $properties['check_homepage'] == 1) {
            echo "*";
        }

        echo "</td><td align=\"left\"><input type=\"text\" name=\"homepage\" size=\"28\" maxlength=\"80\" value=\"";

        if (isset($_COOKIE['homepage']) AND $_COOKIE['homepage'] != "") {
            echo "".$_COOKIE['homepage']."";
        } elseif (isset($_POST['homepage']) AND $_POST['homepage'] != "") {
            echo "".$_POST['homepage']."";
        } else {
            echo "http://";
        }

        echo "\" tabindex=\"3\" /></td>
        </tr>
        <tr>
        <td align=\"left\">ICQ:";

        if (isset($properties['check_icq']) AND $properties['check_icq'] == 1) {
            echo "*";
        }

        echo "</td><td align=\"left\"><input type=\"text\" name=\"icq\" size=\"28\" maxlength=\"9\" value=\"";

        if (isset($_COOKIE['icq']) AND $_COOKIE['icq'] != "") {
            echo "".$_COOKIE['icq']."";
        } elseif (isset($_POST['icq']) AND $_POST['icq'] != "") {
            echo "".$_POST['icq']."";
        }

        echo "\" tabindex=\"4\" /></td>
        </tr>";
	
	echo "<tr><td>
	I am a spammer:*</td><td>
	<input type=\"text\" name=\"anti_spam\" size=\"3\" value=\"yes\">  (Please enter \"no\"!)
	</td>
	</tr>
	";
	
        echo "<tr>
        <td colspan=\"2\" align=\"left\"><textarea rows=\"13\" id=\"text\" name=\"text\" cols=\"44\" tabindex=\"5\" >";

        if (isset($_POST['text'])) {
            echo stripslashes($_POST['text']);
        }

        echo "</textarea></td>
        </tr>
        <tr>
        <td colspan=\"2\" align=\"left\"><input type=\"checkbox\" name=\"save_settings\"";
	
        if (isset($_COOKIE['save_settings']) AND $_COOKIE['save_settings'] == 1) {
            echo " checked=\"checked\"";
        }

        echo " value=\"1\" /> ".$ms[205]."";
	
	
        if (extension_loaded("gd") AND $properties['captcha'] == 1) {
            echo "<br /><br /><img src=\"".$url."/captcha.php\" width=\"100\" height=\"40\" id=\"captcha\" alt=\"Captcha\" /> &nbsp;<input type=\"text\" name=\"captcha\" size=\"6\" maxlength=\"5\" tabindex=\"6\" />";
        }
        echo "</td> </tr>";


	echo "
        <tr>
        <td colspan=\"2\" align=\"left\"><input type=\"submit\" name=\"send\" value=\"".$ms[20]."\" tabindex=\"7\" /> <input type=\"submit\" name=\"preview\" value=\"".$ms[189]."\" tabindex=\"8\" /></td>
        </tr>
        </table>
        </form>";
    } else {
        echo "<b>".$ms[34]."</b>";
    }

    echo "</div>
    </body>
    </html>";
?>