<?php
set_magic_quotes_runtime(0);
include ("txt/vars.php");
$nazv=$_POST['nazv'];
$descr=$_POST['descr'];
$type=$_POST['type'];
$price=$_POST['price'];
$mprice=$_POST['mprice'];
$quantity=$_POST['quantity'];
$srok=$_POST['srok'];
$cat=$_POST['cat'];
$userfile=$_FILES["userfile"]["tmp_name"];
$userfile_name=$_FILES["userfile"]["name"];
$file_size=$_FILES["userfile"]["size"];
$file_type=$_FILES["userfile"]["type"];
$nazv=str_replace ('"',"'",$nazv);
$nazv=substr ($nazv,0,50);
$nazv=htmlspecialchars ($nazv);
$nazv=trim ($nazv);

$descr=str_replace ('"',"'",$descr);
$descr=substr ($descr,0,5000);
$descr=trim ($descr);
$descr=strip_tags($descr,'<p><strong><em><u><strike><sub><sup><ol><li><ul><hr><font>');

$type=str_replace ('"',"'",$type);
$type=substr ($type,0,10);
$type=htmlspecialchars ($type);
$type=trim ($type);

$price=str_replace ('"',"'",$price);
$price=substr ($price,0,10);
$price=htmlspecialchars ($price);
$price=trim ($price);

$mprice=str_replace ('"',"'",$mprice);
$mprice=substr ($mprice,0,10);
$mprice=htmlspecialchars ($mprice);
$mprice=trim ($mprice);

$quantity=str_replace ('"',"'",$quantity);
$quantity=substr ($quantity,0,10);
$quantity=htmlspecialchars ($quantity);
$quantity=trim ($quantity);

$srok=str_replace ('"',"'",$srok);
$srok=substr ($srok,0,50);
$srok=htmlspecialchars ($srok);
$srok=trim ($srok);

$cat=str_replace ('"',"'",$cat);
$cat=htmlspecialchars ($cat);
$cat=trim ($cat);
$nazv=mysql_escape_string($nazv);
$descr=mysql_escape_string($descr);
$type=mysql_escape_string($type);
$price=mysql_escape_string($price);
$mprice=mysql_escape_string($mprice);
$quantity=mysql_escape_string($quantity);
$srok=mysql_escape_string($srok);
$cat=mysql_escape_string($cat);
$nowtime=time();
if ($nazv=="" || $price=="" || $descr=="") {
echo "<center><b>Заполните обязательные поля!</b></center>";
echo "<meta http-equiv='refresh' content='2 url=sell.php'>";
exit;
}
if ($quantity==1) {
$type="one";
}
if ($price<0) {
$price=abs($price);
}
if ($mprice=="" || $mprice<$price) {
$mprice=$price*10000;
}
if ($type=="one" || $quantity=="" || $quantity<=0) {
$quantity=1;
}
if ($type=="unlim") {
$mprice=$price;
$quantity=999999999999;
}
if ($type=="mult") {
$mprice=$price;
}
$time=3600*24*$srok+$nowtime;
$link=mysql_connect("$mysqlhost","$mysqllogin","$mysqlpass") or die("Could not connect");
mysql_select_db($mysqldb) or die("Could not select database");
$query="select foto_size from settings where (first='1')";
$res_size=mysql_query($query);
$row=mysql_fetch_assoc($res_size);
$foto_size=$row["foto_size"];
if ($userfile!="" && $file_size<=$foto_size && $userfile!="none" && eregi ("image",$file_type)) {
$userfile_name=$time.$userfile_name;
if (!copy ("$userfile","photos/$userfile_name")) {
echo "The copying has not taken place!!!!";
exit;
}
}
include ("auth_user.php");
$query="insert into goods values (NULL,'$nazv','$cat','$crc_username','$type','$price','$mprice','$quantity','$time','$userfile_name','$descr','no','0','$nowtime')";
mysql_query($query);
mysql_close ($link);
?>
<script language="JavaScript">
location.href="lots.php";
</script>