<?php
session_start();
include("connect.php");

$action = $_GET['action'];
if(!isset($action)) $action = "home";

IF ($action=="home"){

$text1 = rand(0,9);
$text2 = rand(0,9);
$text3 = "<label for='xzx5'>".$LANGAUGE[176]." ".$text1." + ".$text2."</label>";
$text4 = $text1 + $text2;

$_SESSION["captchacode"] = $text4;

$string = mt_rand();
$string = substr(sha1($string), 0, 6);
$string = str_replace(array('0', 'O', 'o', '9', 'g', 'G'), rand(1, 8), $string);
$datex = time();
$codemembers = $datex.$string;
$codemembers = MD5($codemembers);
$codemembers = substr($codemembers, 0, 15);

if ($htmlorphp=="1"){
$z = "sendmessage.html";
}else{
$z = "box.php?action=send";
}

tpl_header($LANGAUGE[195]);
?>
<script type="text/javascript">
// function to verify registration data
function regCheck(submitform) {
var correct = true;
var emailPat =/^(.+)@(.+)$/;
var matchArray = submitform.sender.value.match(emailPat);

var count = 0;


if (submitform.name.value == "") {
        correct = false;
        alert("<?php echo $LANGAUGE[196]; ?>");
        submitform.name.focus();

} else if (submitform.subject.value == "") {
        correct = false;
        alert("<?php echo $LANGAUGE[173]; ?>");
        submitform.subject.focus();

} else if (matchArray == null) {
        correct = false;
        alert("<?php echo $LANGAUGE[172]; ?>");
        submitform.sender.focus();

} else if (submitform.message.value == "") {
        correct = false;
        alert("<?php echo $LANGAUGE[174]; ?>");
        submitform.message.focus();


} else if (submitform.code.value == "") {
        correct = false;
        alert("<?php echo $LANGAUGE[177]; ?>");
        submitform.code.focus();
}

if (correct) {
        submitform.submit();
}

}
</script>
<?php
$form = '<div class="box">
<form name="signup" method="post" action="'.$z.'">
<input type="hidden" name="codenumber" value="'.$codemembers.'" />

<label for="ttt2">'.$LANGAUGE[198].'</label><br />
<input id="ttt2" size="60" name="name" onfocus="this.select()" type="text" /><br /><br />
<label for="ttt1">'.$LANGAUGE[197].'</label><br />
<input id="ttt1" size="60" name="subject" onfocus="this.select()" type="text" /><br /><br />
<label for="ttt3">'.$LANGAUGE[199].'</label><br />
<input id="ttt3" dir="ltr" size="60" name="sender" onfocus="this.select()" type="text" /><br /><br />
<label for="ttt4">'.$LANGAUGE[200].'</label><br />
<select id="ttt4" size="1" name="cat">';

$sql = mysql_query ("SELECT * FROM msg_cat order by id desc");
while($cat=mysql_fetch_array($sql))
{
$form .= '<option value="'.$cat['id'].'">'.$cat['name'].'</option>';
}
$form .= '</select><br /><br />

<script type="text/javascript">edToolbar(\'mytxtarea\'); </script>
<textarea id="mytxtarea" name="message" rows="15" cols="60"></textarea>

<br /><br />

'.$text3.' <input id="xzx5" name="code" size="10" onfocus="this.select()" /><br /><br />
<input type="button" value=" '.$LANGAUGE[201].' " name="Send" id="Send" onclick="regCheck(signup)" />
</form>
</div>';
bar($namelinks1,$LANGAUGE[195],"","");
table($LANGAUGE[195],$form,1);
tpl_footer();

}ELSEIF ($action=="send"){
if($_POST['code'] != $_SESSION['captchacode'] OR $_SESSION["captchacode"]=='')
{
tpl_header($LANGAUGE[126]);
tpl_table($LANGAUGE[126],$LANGAUGE[178]);
tpl_footer();
exit;
}

$name = text(1,$_POST['name']);
$title = text(1,$_POST['subject']);
$emails = text(1,$_POST['sender']);
$text = text(1,$_POST['message']);
$cat = intval($_POST['cat']);
$codenumber = text(1,$_POST['codenumber']);

$d = time();
$ip = $_SERVER['REMOTE_ADDR'];

$ffff = "";

if($name==""){
$ffff .= $LANGAUGE[202];
$jjjj = "no";
}

if(!eregi('^[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+.([a-zA-z]{2,4})$',$emails)){
$ffff .= $LANGAUGE[203];
$jjjj = "no";
}

if($text==""){
$ffff .= $LANGAUGE[204];
$jjjj = "no";
}

if($title==""){
$ffff .= $LANGAUGE[205];
$jjjj = "no";
}

$queryx = mysql_query("SELECT * FROM msg_box where code='$codenumber'");
$xx = mysql_num_rows($queryx);
if($xx != 0){
$ffff .= $LANGAUGE[206];
$jjjj = "no";
}

if ($htmlorphp=="1"){
$z = "messagecode-$codenumber.html";
}else{
$z = "box.php?action=show&code=$codenumber";
}

if($jjjj != "no"){
$query =  mysql_query ("INSERT INTO msg_box (name,title,emails,date,text,cat,ip,showadmin,replayadmin,showuser,closemsg,code) VALUES ('$name','$title','$emails','$d','$text','$cat','$ip',0,0,0,0,'$codenumber')") or die ("error msg");
$msg = $LANGAUGE[207];
$msg .= "<div align='center'><a href='$z'>".$LANGAUGE[208]."</a></div>";
}else{
$msg = $ffff.$LANGAUGE[131];
}

tpl_header($LANGAUGE[126]);
bar($namelinks1,$LANGAUGE[126],"","");
table($LANGAUGE[126],$msg,1);
tpl_footer();

}ELSEIF ($action=="show"){
$code = addslashes($_GET["code"]);

$Sql = mysql_query("select * from msg_box where code='$code' AND closemsg=0");
$p = @mysql_fetch_array($Sql);
if (!$p)
{
error();
exit;
}

include('includes/bbcode.php');

$p['name'] = text(3,$p['name']);
$p['title'] = text(3,$p['title']);
$p['emails'] = text(3,$p['emails']);
$p['text'] = text(3,$p['text']);

$text = Replace($p['text']);
$text = str_replace("[LIST]","<ul>",$text);
$text = str_replace("[/LIST]","</ul>",$text);
$text = str_replace("[LIST1]","<ol>",$text);
$text = str_replace("[/LIST1]","</ol>",$text);
$text = str_replace("[*]","<li>",$text);

$d = date("j/n/Y",$p['date']);

$query3 = mysql_query("SELECT * FROM msg_cat where id='".$p['cat']."'");
$p3 = mysql_fetch_array($query3);

tpl_header($p['name']);
bar($namelinks1,$p['title'],"","");

$msg = "<table class='xtable' width='100%' id='AutoNumber15'>

<tr>
<td width='30%' class='xtr'>".$LANGAUGE[209]."</td>
<td width='70%' class='xtd'>".$p['title']."</td>
</tr>

<tr>
<td width='30%' class='xtr'>".$LANGAUGE[210]."</td>
<td width='70%' class='xtd'>".$p['name']."</td>
</tr>

<tr>
<td width='30%' class='xtr'>".$LANGAUGE[211]."</td>
<td width='70%' class='xtd'>".$d."</td>
</tr>

<tr>
<td width='30%' class='xtr'>".$LANGAUGE[212]."</td>
<td width='70%' class='xtd'>".$p3['name']."</td>
</tr>

<tr>
<td width='100%' colspan='2' class='xtd'>".$text."</td>
</tr>

</table>";





$query4 = mysql_query("SELECT * FROM msg_replay where idmsg='".$p['id']."' order by id desc limit 0,10");
$xx = mysql_num_rows($query4);
if($xx == 0){
$msg .= "<br /><div class='boxborder'>".$LANGAUGE[213]."</div>";
}else{
$msg .= "<br />";
while($ps = mysql_fetch_array($query4))
{
$ps['text'] = text(3,$ps['text']);
$text2 = Replace($ps['text']);
$text2 = str_replace("[LIST]","<ul>",$text2);
$text2 = str_replace("[/LIST]","</ul>",$text2);
$text2 = str_replace("[LIST1]","<ol>",$text2);
$text2 = str_replace("[/LIST1]","</ol>",$text2);
$text2 = str_replace("[*]","<li>",$text2);

$d = date("j/n/Y",$ps['date']);

if($ps['useroradmin']==1){
$j = "replayadmin";
}else{
$j = "replay";
}

$msg .= "<div class='".$j."'>
<span>".$LANGAUGE[214]." ".$d."</span><br /><br />
".$text2."
</div>";
}

if ($htmlorphp=="1"){
$z = "replay.html";
}else{
$z = "box.php?action=re";
}

$msg .= "<div align='center'><br /><form method='POST' action='$z'>
<input type='hidden' name='id' value='".$p['id']."' />
<input type='hidden' name='code' value='".$p['code']."' />
<input name='delete' type='submit' value=' ".$LANGAUGE[215]." ' /></form></div>";

$query2 =  mysql_query("UPDATE msg_box SET showuser='1' where code='$code'");
}

table($p['title'],$msg,1);
tpl_footer();

}ELSEIF ($action=="re"){
$id = intval($_POST['id']);
$code = text(3,$_POST['code']);

$query = mysql_query("SELECT * FROM msg_box where id='$id'");
$p = mysql_fetch_array($query);
$p['title'] = text(3,$p['title']);

if ($htmlorphp=="1"){
$z = "replaysend.html";
}else{
$z = "box.php?action=insertreplay";
}

$mmsg = "<div class='box'>
<form name='vbform' method='POST' action='$z'>
<input type='hidden' name='idmsg' value='$id' />
<input type='hidden' name='code' value='$code' />
<!-- ".$LANGAUGE[216]." ".$p['title']."<br /><br /> -->
<script type='text/javascript'>edToolbar('mytxtarea'); </script>
<textarea id='mytxtarea' name='message' rows='15' cols='60'></textarea><br /><br />
<input type='submit' value=' ".$LANGAUGE[201]." ' name='B1'>
</form>
</div>";

tpl_header($LANGAUGE[216]);
bar($namelinks1,$LANGAUGE[216],"","");

table($LANGAUGE[216]." ".$p['title'],$mmsg,1);
tpl_footer();

}ELSEIF ($action=="insertreplay"){
$idmsg = intval($_POST['idmsg']);
$text = text(1,$_POST['message']);
$dd = time();
$code = text(1,$_POST['code']);

tpl_header($LANGAUGE[126]);
bar($namelinks1,$LANGAUGE[126],"","");

if (empty($text)){
$ddds = $LANGAUGE[217];
}else{
$query =  mysql_query ("INSERT INTO msg_replay (text,useroradmin,idmsg,date) VALUES ('$text','9','$idmsg','$dd')") or die ("error replay");

if ($htmlorphp=="1"){
$z = "messagecode-$code.html";
}else{
$z = "box.php?action=show&code=$code";
}

$ddds = $LANGAUGE[218];
$ddds .= "<META HTTP-EQUIV='refresh' CONTENT='1; URL=$z' />";
}

table($LANGAUGE[126],$ddds,1);
tpl_footer();
}
?>