tic4301/admin.php at main · maynardwhy/tic4301 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
<!DOCTYPE html>
<html>
<body>

<h1 style="text-align:center; padding-top: 100px">Admin Page</h1>

<?php
    session_start();

    //check if session is logged as admin
    if( !isset($_SESSION['isLoggedIn']) && !isset($_SESSION['isAdmin']) ) {
        header("Location: index.php");
        die( "Login required.");
    }
?>

<?php
  //connect to database
  require_once 'config.php';
  $conn = new mysqli(DB_HOST, DB_USERNAME, DB_PASSWORD, DB_NAME);
  if ($mysqli->connection_error) { die("Connection failed: " . $mysqli->connect_error); }

//COMMENTS

  //View All Comments
  if(isset($_POST['comments'])){
    $sql = "SELECT * FROM form";
      if ($showing = $conn->query($sql)){

        while ($row = $showing->fetch_assoc()) {
          $col1 =$row["form_id"];
          $col2 = $row["comment"];
          $col3 = $row["user_id"];

          echo "ID: " . $col1 .
          "  ,  Comment: " . $col2 .
          " , UID: " . $col3 .
          "<br>";
        }
      }
  }

//Delete Comments
if(isset($_POST['deletecom'])) {
  $did = $_POST['id'];

  $sql = "DELETE FROM form WHERE form_id = '$did'";
  $sql_ifexist = "SELECT form_id FROM form WHERE form_id = '$did'";
  $num = $conn->query($sql_ifexist);

  if($num->num_rows == 0){
    echo "Record Does Not Exist";
  }
  else {
    if($result=$conn->query($sql)){
      echo "Record Number: " . $did . " Deleted";
    }
    else {
      echo "Error in Deleting";
    }
  }
}

//USERS

  //View All Users
  if(isset($_POST['view'])){
    $sql = "SELECT * FROM users";
      if ($showing = $conn->query($sql)){

        while ($row = $showing->fetch_assoc()) {
          $col1 =$row["id"];
          $col2 = $row["user_id"];

          echo "ID: " . $col1 .
          "  ,  UID: " . $col2 . "<br>";
        }
      }
  }

  //Create New User
  if(isset($_POST['create'])){
    $userid = $_POST['user'];
    $pwd = $_POST['password'];

    $sqlcheck = "SELECT user_id FROM users WHERE user_id = '$userid'";
    $sql = "INSERT INTO users (user_id, pwd) VALUES ('$userid','$pwd')";
    $results = $conn->query($sqlcheck);

    if($results->num_rows > 0){
      echo "User Exists";
    }
    else {
      $result = $conn->query($sql);
      echo "User " . $userid . " Added";
    }
  }

  //Delete Users
  if(isset($_POST['delete'])) {
    $did = $_POST['id'];
    if ($did == 1){
      echo "Not Allowed to delete Admin - ";
      $did = "";
    }

    $sql = "DELETE FROM users WHERE id = '$did'";
    $sql_ifexist = "SELECT id FROM users WHERE id = '$did'";
    $num = $conn->query($sql_ifexist);

    if($result->num_rows == 0){
      echo "Record Does Not Exist";
    }
    else {
      if($result=$conn->query($sql)){
        echo "Record Number: " . $did . " Deleted";
      }
      else {
        echo "Error in Deleting";
      }
    }
  }

  if(isset($_POST['back'])){
    header('Location: welcome.php');
  }
?>

<form style="text-align:center; padding:30px;" action="admin.php" method= "post"s>
  <input name='view' type='submit' value='View All Users'/>
  <input name='comments' type='submit' value='View All Comments'/>
  <br></br>
</form>

<form style="text-align:center; padding:30px;" action="admin.php" method= "post"s>
  <label for="id">ID:</label>
  <input id="id" name="id" required="" type="number" />
  <input name='delete' type='submit' value='Delete User'/>
  <input name='deletecom' type='submit' value='Delete Comment'/>
</form>

<form style="text-align:center; padding:30px;" action="admin.php" method= "post">
  <!-- input for username -->
  <label for="user">Username:</label>
  <input id="user" name="user" required="" type="text" />
  <!-- input for password -->
  <label for="password">Password:</label>
  <input id="password" name="password" required="" type="password" />
  <!-- create user -->
  <input name='create' type='submit' value="Create"/>
</form>

<form style="text-align:center; padding:30px;" action="admin.php" method= "post">
  <input name='back' type='submit' value='Back'/>
</form>

</body>
</html>