stuff-sharing/edituser.php at master · cs2102-stuff-sharing/stuff-sharing · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
<?php
  session_start();

  include('db.php');
  include('header.php');

  if(!isset($_SESSION['key']))
  {
  	header("Location: /stuff-sharing/login.php?error=NOT_LOGIN");
  }
  else
  {
	$email = pg_escape_string($connection,$_SESSION['key']);
    $query = "SELECT firstName, lastName, isAdmin FROM users where email='".$email."'";
    $result = pg_query($connection,$query) or die('Query failed:'.pg_last_error());
    $cRow = pg_fetch_row($result);
    if(!$cRow[2])
    {
    	header("Location: /stuff-sharing/error.php");
    }
  }

	if(isset($_SESSION['userid']))
	{
		$userid = pg_escape_string($connection,$_SESSION['userid']);
		$updateResult = pg_query($connection,"SELECT u.firstname, u.lastname, u.dob, u.email, u.userpoint, u.blacklistcount
		FROM users u WHERE u.email='".$userid."'");
		if(!$updateResult)
		{
			$row = pg_fetch_row($updateResult);
			$message = "Something seems to be wrong, please try later ";
		}
		else
		{
			$row = pg_fetch_row($updateResult);
			$userFName = $row[0];
			$userLName = $row[1];
			$userDOB = $row[2];
			$userEmail = $row[3];
			$userPoint = $row[4];
			$userBCount = $row[5];

		}
	}

  if(isset($_POST['action']) && $_POST['action'] == "userid")
  {
		$newFName = pg_escape_string($connection,$_POST['userFName']);
		$newLName = pg_escape_string($connection,$_POST['userLName']);
		if (!empty($_POST['userPassword']))
		{
			$newPassword = pg_escape_string($connection,$_POST['userPassword']);
		}
		$newDOB = pg_escape_string($connection,$_POST['userDOB']);
		$newEmail = pg_escape_string($connection, $_POST['userEmail']);
		$newUserPoint = pg_escape_string($connection, $_POST['userPoint']);
		$newBLCount = pg_escape_string($connection, $_POST['userBCount']);
		if(isset($newPassword))
		{
			$updateIDQuery = "UPDATE users SET firstname='".$newFName."', lastname='".$newLName."', password='".md5($newPassword)."', dob='".$newDOB."', userpoint =".$newUserPoint.", blacklistcount='".$newBLCount."'
			WHERE email = '".$userEmail."'";
		}
		else
		{
			$updateIDQuery = "UPDATE users SET firstname='".$newFName."', lastname='".$newLName."', dob='".$newDOB."',email='".$newEmail."', userpoint =".$newUserPoint.", blacklistcount='".$newBLCount."'
			WHERE email = '".$userEmail."'";
		}
	  $updateIDResult = pg_query($connection, $updateIDQuery);

		if($updateIDResult){
			echo ("
			<div class=\"alert alert-info\">
				<a href=\"#\" class=\"close\" data-dismiss=\"alert\" aria-label=\"close\">&times;</a>
				User updated!
			</div>
					");

		}

		//header("Refresh: 10; Location: /stuff-sharing/updateParticular.php");
		//header(Location: /stuff-sharing/updateParticular.php");
  }

?>

<body>
    <?php
      include('admin_navbar.php');
    ?>

<div class="container">
  <div class="row">
    <div class="col-md-4 col-md-offset-4">
      <div class="panel panel-default">
        <div class="panel-heading">
          <h3 class="panel-title">Edit User Page</h3>
        </div>
        <div class="panel-body">
          <?php
            if(isset($message))
            {
              echo '<div class="alert alert-danger" role="alert">
                      <span class="glyphicon glyphicon-exclamation-sign" aria-hidden="true"></span>
                      <span class="sr-only">Error:</span>' .
                      $message .
                    '</div>';
            }
          ?>
          <form action="edituser.php" method="post">
            <fieldset>
              <div class="form-group">
                <input class="form-control" id="user-fname" name="userFName" type="text" placeholder="User First Name" value = "<?php echo $userFName;?>" autofocus>
              </div>
			  <div class="form-group">
                <input class="form-control" id="user-lname" name="userLName" type="text" placeholder="User Last Name" value = "<?php echo $userLName;?>" autofocus>
              </div>
			  <div class="form-group">
                <input class="form-control" id="user-password" name="userPassword" type="text" placeholder="User Password">
              </div>
			  <div class="form-group">
                <input class="form-control" id="user-dob" name="userDOB" type="text" placeholder="User DOB" value = "<?php echo $userDOB;?>" autofocus>
              </div>
			  <div class="form-group">
                <input class="form-control" id="user-email" name="userEmail" type="text" placeholder="User Email" value = "<?php echo $userEmail;?>" autofocus>
              </div>
			  <div class="form-group">
                <input class="form-control" id="user-point" name="userPoint" type="text" placeholder="User Point" value = "<?php echo $userPoint;?>" autofocus>
              </div>
			  <div class="form-group">
                <input class="form-control" id="user-bcount" name="userBCount" type="text" placeholder="User Black List Count" value = "<?php echo $userBCount;?>" autofocus>
              </div>


              <div class="form-group">
                <input class="form-control" name="action" type="hidden" value="userid" />
              </div>
              <button type="submit" class="btn btn-success btn-block">edit user</button>

            </fieldset>
          </form>
        </div>
      </div>
    </div>
  </div>
</div>
</body>