Issues (1369)

annonce.php (6 issues)

1
<?php
2
3
/**
4
 * annonce.php
5
 *
6
 * Announces for trading between players
7
 *
8
 * @version 1.0s - Security checked for SQL-injection by Gorlum for http://supernova.ws
9
 * @version 1.0
10
 * @copyright 2008 by ??????? for XNova
11
 */
12
13
include('common.' . substr(strrchr(__FILE__, '.'), 1));
14
15
$users = db_user_by_id($user['id'], false);
0 ignored issues
show
Deprecated Code introduced by
The function db_user_by_id() has been deprecated. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

15
$users = /** @scrutinizer ignore-deprecated */ db_user_by_id($user['id'], false);
Loading history...
16
$action = sys_get_param_int('action');
17
$GET_id = sys_get_param_int('id');
18
19
lng_include('announce');
20
21
switch ($action) {
22
  case 1://on veut poster une annonce
23
    $page .= '<HTML>
24
    <center>
25
    <br>
26
    <table width="600">
27
    <td class="c" colspan="10" align="center"><b><font color="white">' . $lang['Classifieds'] . '</font></b></td></tr>
28
    <form action="annonce.php?action=2" method="post">
29
    <td class="c" colspan="10" align="center"><b>' . $lang['Resources_to_be_sold'] . '</font></b></td>
30
    <tr><th colspan="5">' . $lang['metal'] . '</th><th colspan="5"><input type="texte" value="0" name="metalvendre" /></th></tr>
31
    <tr><th colspan="5">' . $lang['crystal'] . '</th><th colspan="5"><input type="texte" value="0" name="cristalvendre" /></th></tr>
32
    <tr><th colspan="5">' . $lang['deuterium'] . '</th><th colspan="5"><input type="texte" value="0" name="deutvendre" /></th></tr>
33
34
    <td class="c" colspan="10" align="center"><b>' . $lang['Desired_resources'] . '</font></b></td></tr>
35
    <tr><th colspan="5">' . $lang['metal'] . '</th><th colspan="5"><input type="texte" value="0" name="metalsouhait" /></th></tr>
36
    <tr><th colspan="5">' . $lang['crystal'] . '</th><th colspan="5"><input type="texte" value="0" name="cristalsouhait" /></th></tr>
37
    <tr><th colspan="5">' . $lang['deuterium'] . '</th><th colspan="5"><input type="texte" value="0" name="deutsouhait" /></th></tr>
38
    <tr><th colspan="10"><input type="submit" value="' . $lang['send'] . '" /></th></tr>
39
40
    <form>
41
    </table>
42
    </HTML>';
43
44
    SnTemplate::display($page);
45
  break;
46
47
  case 2:// On vient d'envoyer une annonce, on l'enregistre et on affiche un message comme quoi on l'a bien fait
48
    $metalvendre = sys_get_param_float('metalvendre');
49
    $metalsouhait = sys_get_param_float('metalsouhait');
50
    $cristalvendre = sys_get_param_float('cristalvendre');
51
    $cristalsouhait = sys_get_param_float('cristalsouhait');
52
    $deutvendre = sys_get_param_float('deutvendre');
53
    $deutsouhait = sys_get_param_float('deutsouhait');
54
55
    if (($metalvendre != 0 && $metalsouhait == 0) || ($cristalvendre != 0 && $cristalsouhait == 0) || ($deutvendre != 0 && $deutsouhait == 0)) {
56
      doquery("INSERT INTO {{annonce}} SET `user` ='{$users['username']}', `galaxie` ='{$users['galaxy']}', `systeme` ='{$users['system']}', `metala` ='{$metalvendre}', `cristala` ='{$cristalvendre}', `deuta` ='{$deutvendre}', `metals` ='{$metalsouhait}', `cristals` ='{$cristalsouhait}', `deuts` ='{$deutsouhait}'");
0 ignored issues
show
Deprecated Code introduced by
The function doquery() has been deprecated. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

56
      /** @scrutinizer ignore-deprecated */ doquery("INSERT INTO {{annonce}} SET `user` ='{$users['username']}', `galaxie` ='{$users['galaxy']}', `systeme` ='{$users['system']}', `metala` ='{$metalvendre}', `cristala` ='{$cristalvendre}', `deuta` ='{$deutvendre}', `metals` ='{$metalsouhait}', `cristals` ='{$cristalsouhait}', `deuts` ='{$deutsouhait}'");
Loading history...
57
      SnTemplate::messageBox($lang['Your_announce_was_recorded'], $lang['announce_status'], "annonce.php");
58
    } else {
59
      SnTemplate::messageBox($lang['Your_announce_not_recorded'], $lang['announce_status'], "annonce.php?action=1");
60
    }
61
  break;
62
63
  case 3://Suppression d'annonce
64
    doquery("DELETE FROM {{annonce}} WHERE `id` = {$GET_id}");
0 ignored issues
show
Deprecated Code introduced by
The function doquery() has been deprecated. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

64
    /** @scrutinizer ignore-deprecated */ doquery("DELETE FROM {{annonce}} WHERE `id` = {$GET_id}");
Loading history...
65
    SnTemplate::messageBox($lang['Your_announce_was_deleted'], $lang['announce_status'], "annonce.php");
66
  break;
67
68
  default://Sinon on affiche la liste des annonces
69
    $annonce = doquery("SELECT * FROM {{annonce}} ORDER BY `id` DESC ");
0 ignored issues
show
Deprecated Code introduced by
The function doquery() has been deprecated. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

69
    $annonce = /** @scrutinizer ignore-deprecated */ doquery("SELECT * FROM {{annonce}} ORDER BY `id` DESC ");
Loading history...
70
71
    $page2 = "<HTML><center><br>
72
    <table width=\"600\">
73
    <td class=\"c\" colspan=\"10\"><font color=\"#FFFFFF\">{$lang['Classifieds']}</font></td></tr>
74
    <tr><th colspan=\"3\">{$lang['Infos_of_delivery']}</th><th colspan=\"3\">{$lang['Resources_to_be_sold']}</th><th colspan=\"3\">{$lang['Desired_resources']}</th><th>{$lang['Action']}</th></tr>
75
    <tr><th>{$lang['Salesman']}</th><th>{$lang['Galaxy']}</th><th>{$lang['Solar_system']}</th><th>{$lang['metal']}</th><th>{$lang['crystal']}</th><th>{$lang['deuterium']}</th><th>{$lang['metal']}</th><th>{$lang['crystal']}</th><th>{$lang['deuterium']}</th><th>{$lang['Delete']}</th></tr>";
76
77
    while ($b = db_fetch($annonce)) {
0 ignored issues
show
Deprecated Code introduced by
The function db_fetch() has been deprecated. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

77
    while ($b = /** @scrutinizer ignore-deprecated */ db_fetch($annonce)) {
Loading history...
78
      $page2 .= '<tr><th>';
79
      foreach ($b as $name => $value) {
80
        if ($name != 'id') {
81
          $page2 .= $value;
82
          $page2 .= '</th><th>';
83
        }
84
      }
85
      $page2 .= ($b['user'] == $users['username']) ? "<a href=\"annonce.php?action=3&id={$b[id]}\">X</a></th></tr>" : "</th></tr>";
0 ignored issues
show
The constant id was not found. Maybe you did not declare it correctly or list all dependencies?
Loading history...
86
    }
87
88
    $page2 .= "<tr><th colspan=\"10\" align=\"center\"><a href=\"annonce.php?action=1\">{$lang['add_announce']}</a></th></tr></td></table></HTML>";
89
90
    SnTemplate::display($page2);
91
  break;
92
}
93
94
// Créé par Tom1991 Copyright 2008
95
// Modifié par BenjaminV
96