[StealthThrax]

does anyone see why when I create a new page. That whatever is on the home page is on the new pages and I cant edit the new pages separately?

pages.php

Code

<?php
session_start();
require_once('../config.php');
if(session_is_registered("username"))
{
$username = $_SESSION['username'];
$hash = $_SESSION['hash'];
require_once('../config.php');
mysql_connect($sqlserver,$sqluser,$sqlpass);
mysql_select_db("$sqlname") or die(mysql_error());
$result = mysql_query("SELECT * from users where username='$username' and password='$hash'");
if (mysql_num_rows($result) == 0)
{
header('Location: login.php');
exit();
}
}
else
{
header('Location: login.php');
exit();
}
echo "<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>";
mysql_connect($sqlserver,$sqluser,$sqlpass); // Connect to the MySQL server
require_once('inc.php');
?>

<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8" />
<meta name="keywords" content="" />
<meta name="author" content="" />
<link rel="stylesheet" type="text/css" href="bulletprooftheme.css" />
<title>Create Page</title>
</head>
<body>
<div id="thetop">
<a id="top"></a>
<p class="hide">Skip to: <a href="#sitemenu" accesskey="2">Site menu</a> | <a href="#maincontent" accesskey="3">Main content</a></p>
</div>

<div id="container">
<div id="main">

<div id="logo">
<h1><img src="../IMG/Bulletproof-vest-logo.jpg" height="200" width="200"></h1>
<span id="tagline">Administration Area:</span>
</div>

<div class="clear"></div>
<h3 class="headerstyle"><a href="<?php echo $path ?>">Home</a> &raquo; <a href="<?php echo $path ?>manage">Admin Panel</a> &raquo; Create/Edit Pages </h3>
<table style="float: left;" class="center" width="100%" border="1">
<?php
while($row = mysql_fetch_array( $pages ))
{
echo "<tr><td>";
echo $row['formal_name'];
echo ('</td><td><a href="edit.php?name='.$row['name'].'">Edit</a> | <a href="delete.php?name='.$row['name'].'">Remove</a></td>');
echo "</tr>";
}
?>
</table>
<br />
<h3>New Page:</h3>
<form action="create.php" method="post">
<table style="float: left;" class="center" width="100%" border="1">
<tr>
<td>Page Name:</td>
<td><input name="name" type="text" /></td>
</tr>
<tr>
<td>Page Ant:</td>
<td><input name="ant" type="text" /></td>
</tr>
<tr>
<td>Visible in menu:</td>
<td><select name="menu"><option value="1">Yes</option><option value="0">No</option></select></td>
</tr>
</table>
<input type="hidden" name="_submit_check1" value="1"/>
<input type="submit" value="Create Page" />
</form>
<p class="center"><a href="<?php echo $path ?>manage">[Go Back]</a></p>
<br />


</div>
<div class="clear">&nbsp;</div>
</div>

<div id="footer">
<p><?php echo $copyright ?></p>
<p>Powered by <a href="http://www.///////////">Title</a></p>
<p><a href="logout.php">Logout</a></p>
</div>
</body>
</html>

edit.php

Code

<?php
session_start();
require_once('../config.php');
if(session_is_registered("username"))
{
$username = $_SESSION['username'];
$hash = $_SESSION['hash'];
require_once('../config.php');
mysql_connect($sqlserver,$sqluser,$sqlpass);
mysql_select_db("$sqlname") or die(mysql_error());
$result = mysql_query("SELECT * from users where username='$username' and password='$hash'");
if (mysql_num_rows($result) == 0)
{
header('Location: login.php');
exit();
}
}
else
{
header('Location: login.php');
exit();
}
echo "<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>";
mysql_connect($sqlserver,$sqluser,$sqlpass); // Connect to the MySQL server
require_once('inc.php');
include("fckeditor/fckeditor.php") ;
$name = $_GET['name'];
if (array_key_exists('_submit1_check', $_POST)) {

$page = $_POST['FCKeditor1'];
$formal = $_POST['formal'];
$ant = $_POST['ant'];
$menu = $_POST['menu'];
$name = $_GET['name'];

mysql_query("UPDATE pages SET value = '$page' WHERE name='$name'");
mysql_query("UPDATE pages SET formal_name = '$formal' WHERE name='$name'");
mysql_query("UPDATE pages SET name = '$ant' WHERE name='$name'");
mysql_query("UPDATE pages SET navigation = '$menu' WHERE name='$name'");
$name = $ant;
$submit = yes;
}
?>

<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8" />
<link rel="stylesheet" type="text/css" href="bulletprooftheme.css" />
<title>Administration Area</title>
</head>
<body>
<div id="thetop">
<a id="top"></a>
<p class="hide">Skip to: <a href="#sitemenu" accesskey="2">Site menu</a> | <a href="#maincontent" accesskey="3">Main content</a></p>
</div>

<div id="container">
<div id="main">

<div id="logo">
<h1><img src="../IMG/Bulletproof-vest-logo.jpg" alt="CMS Logo" height="200" width="200"></h1>
<span id="tagline">Administration Area:</span>
</div>

<div class="clear"></div>
<h3 class="headerstyle"><a href="<?php echo $path ?>">Home</a> &raquo; <a href="<?php echo $path ?>manage">Admin Panel</a> &raquo; <a href="<?php echo $path ?>manage/pages.php">Create/Edit Pages</a> &raquo; Edit Page</h3>
<form action="edit.php?name=<?php echo $name ?>" method="post">
<?php

if ($submit != yes)
{

$pages = mysql_query("SELECT * FROM pages where name = '$name'");
$pagerow = mysql_fetch_array($pages) or die(mysql_error());
$name = $pagerow['value'];
echo '<table style="float: left;" class="center" width="100%" border="1">';
echo "<tr>";
echo ('<td><h3>Formal Name:</h3><input name="formal" type="text" value="'.$pagerow['formal_name'].'" /></td>');
echo ('<td><h3>Page Ant:</h3><input name="ant" type="text" value="'.$pagerow['name'].'" /></td>');
echo "</tr>";
echo "<tr>";
echo '<td><h3>Visible in menu:</h3></td>';
echo '<td><select name="menu"><option value="1">Yes</option><option value="0">No</option></select></td>';
echo "</tr>";
echo "</table>";
$oFCKeditor = new FCKeditor('FCKeditor1');
$oFCKeditor->BasePath = '/manage/fckeditor/';
$oFCKeditor->Value = $name;
$oFCKeditor->Create();
}
else
{
echo "<h2>Page Saved</h2>";
$pages = mysql_query("SELECT * FROM pages where name = '$name'");
$pagerow = mysql_fetch_array($pages) or die(mysql_error());
$name = $pagerow['value'];
echo '<table style="float: left;" class="center" width="100%" border="1">';
echo "<tr>";
echo ('<td><h3>Formal Name:</h3><input name="formal" type="text" value="'.$pagerow['formal_name'].'" /></td>');
echo ('<td><h3>Page Ant:</h3><input name="ant" type="text" value="'.$pagerow['name'].'" /></td>');
echo "</tr>";
echo "<tr>";
echo '<td><h3>Visible in menu:</h3></td>';
echo '<td><select name="menu"><option value="1">Yes</option><option value="0">No</option></select></td>';
echo "</tr>";
echo "</table>";
$oFCKeditor = new FCKeditor('FCKeditor1');
$oFCKeditor->BasePath = '/manage/fckeditor/';
$oFCKeditor->Value = $name;
$oFCKeditor->Create();
}
?>
<input type="hidden" name="_submit1_check" value="1"/>
<input type="submit" value="Save Page" />
</form>

<br />
<p class="center"><a href="<?php echo $path ?>manage/pages.php">[Go Back]</a></p>
<br />


</div>

<div class="clear">&nbsp;</div>
</div>

<div id="footer">
<p><?php echo $copyright ?></p>
<p>Powered by <a href="http:///////">title</a></p>
<p><a href="logout.php">Logout</a></p>
</div>
</body>
</html>

[mothh]

Because you search on the name, when you change the name that entry become invalid.

Try changing it to id.

Something more important, don't use the MySQL extension anymore, it is outdated and deprecated, use PDO or MySQLi instead.

A tutorial for PDO:
https://www.youtube.com/playlist?list=PL...KtWVjA46HC

[Meowie]

By the way, please fix your edit.php code
It is full of easily-exploitable SQL injections.
Just use prepared statements as the guy above suggested or escape the input.

[StealthThrax]

By the way, please fix your edit.php code
It is full of easily-exploitable SQL injections.
Just use prepared statements as the guy above suggested or escape the input.

So basically from what i read on PDO is i should make it like this

Code

$sql = "UPDATE pages
  SET value = ?, formal_name = ?, name = ?, navigation = ?
  WHERE name=?");
$stmt = $pdo->prepare($sql);
$stmt->execute([$page, $formal, $ant, $menu, $name]);

---

Because you search on the name, when you change the name that entry become invalid.

Try changing it to id.

Can you quote which section you have referred to above?

[Meowie]

Yeah, that's what PDO is used for.
No SQLi if used properly.

[mothh]

Just use PDO and it should fix it, if that doesn't fix it I will help you with the other code.

[StealthThrax]

Just use PDO and it should fix it, if that doesn't fix it I will help you with the other code.

I will give it a shot after work, and let you know. Thanks for all the help.

[StealthThrax]

Just use PDO and it should fix it, if that doesn't fix it I will help you with the other code.

I converted it to Mysqli still something wrong in the php part.