<?php
include ("ad_header.php");
if (isset ($_POST['action'])) {
$action=$_POST['action'];
}
else {
die("Вы не указали действие!");
}

if ($action=="change") {
$com=$_POST['com'];
$nazv=$_POST['nazv'];
$descr=$_POST['descr'];
$type=$_POST['type'];
$price=$_POST['price'];
if ($type!="one") {
$mprice=$price;
}
else {
$mprice=$_POST['mprice'];
}
if ($type=="unlim") {
$quantity=999999999999;
}
if ($type=="one") {
$quantity=1;
}
if ($type=="mult") {
$quantity=$_POST['quantity'];
}
$cat=$_POST['cat'];

$nazv=str_replace ('"',"'",$nazv);
$nazv=substr ($nazv,0,50);

$nazv=trim ($nazv);

$descr=str_replace ('"',"'",$descr);
$descr=substr ($descr,0,5000);
$descr=trim ($descr);
$descr=strip_tags($descr,'<p><strong><em><u><strike><sub><sup><ol><li><ul><hr><font><br><b><i>');

$type=str_replace ('"',"'",$type);
$type=substr ($type,0,10);
$type=htmlspecialchars ($type);
$type=trim ($type);

$price=str_replace ('"',"'",$price);
$price=substr ($price,0,10);
$price=htmlspecialchars ($price);
$price=trim ($price);

$mprice=str_replace ('"',"'",$mprice);
$mprice=substr ($mprice,0,10);
$mprice=htmlspecialchars ($mprice);
$mprice=trim ($mprice);

$quantity=str_replace ('"',"'",$quantity);
$quantity=substr ($quantity,0,10);
$quantity=htmlspecialchars ($quantity);
$quantity=trim ($quantity);

$cat=str_replace ('"',"'",$cat);
$cat=htmlspecialchars ($cat);
$cat=trim ($cat);
$nazv=mysql_escape_string($nazv);
$descr=mysql_escape_string($descr);
$type=mysql_escape_string($type);
$price=mysql_escape_string($price);
$mprice=mysql_escape_string($mprice);
$quantity=mysql_escape_string($quantity);
$cat=mysql_escape_string($cat);
if ($price<0) {
$price=abs($price);
}
if ($mprice=="" || $mprice<$price) {
$mprice=$price*10000;
}
if ($nazv=="" || $price=="" || $descr=="") {
echo "<center><b>Заполните обязательные поля!</b></center>";
echo "<meta http-equiv='refresh' content='2 url=ad_lot.php?com=$com'>";
exit;
}
$query="update goods set name='$nazv',parent='$cat',type='$type',price='$price',mprice='$mprice',quantity='$quantity',descr='$descr' where (first='$com')";
mysql_query($query);
}

if ($action=="delete") {
$com=$_POST['com'];
$query="select photo from goods where (first='$com')";
$resphoto=mysql_query($query);
$photorow=mysql_fetch_assoc($resphoto);
$photo_of_good=$photorow["photo"];
if (file_exists("../photos/$photo_of_good") && $photo_of_good!="") {
unlink("../photos/$photo_of_good");
}
$query="delete from goods where (first='$com')";
if (mysql_query($query)) {
echo "<script language='JavaScript'>\n";
echo "alert(\"Товар был успешно удален!\");\n";
echo "</script>";
}
}
mysql_close ($link);
?>

<form action="ad_lot.php" name=redir method=post>
<input type=hidden name=com value="<?php echo "$com"; ?>">
</form>
<form action="ad_goods.php" name=redird method=post>
</form>
<script language="JavaScript">
<?php
if ($action=="delete") {
echo "redird.submit();";
}
else {
echo "redir.submit();";
}
?>
</script>