<?php
include "globals.php";
echo "<center>";
if($_GET['action'])
{
if(!in_array($_GET['action'], array('remove','add')))
{
echo "Invalid action!<br/>
<hr width='750px'>><a href='display.php'>Back</a><hr width='750px'>";
$h->endpage();
exit();
}
}
$_GET['XID'] = isset($_GET['XID']);
switch($_GET['action'])
{
case 'remove' :
remove();
break;
case 'add' :
add();
break;
default :
display();
break;
}
function display()
{
global $ir, $h, $db, $query;
echo "<center><h1>Display Case</h1>";
$_GET['XID'] = abs(intval($_GET['XID']));
if(!$_GET['XID'])
{
echo "Invalid ID
<hr width='750px'>><a href='display.php'>Back</a><hr width='750px'>";
$h->endpage();
exit();
}
else
{
$query = array();
$db->query("SELECT `display_case`
FROM `users`
WHERE `userid` = '".mysql_real_escape_string($_GET['XID'])."'
AND `display_case` = 'yes'");
if(!$db->num_rows($plys))
{
echo "Sorry, This user does not have a display case!
<hr width='750px'>><a href='display.php'>Back</a><hr width='750px'>";
$h->endpage();
exit();
}
else
{
if($_GET['ID'] == $ir['userid'])
{
echo "<b>><a href='display.php?action=add'>Add items</a> |
><a href='display.php?action=remove'>Remove items</a></b><hr width = '750px'/>";
}
$py = array();
$py = $db->fetch_row($plys);
$query = array();
$db->query("SELECT *
FROM `player_display_items` pdi
LEFT JOIN `inventory` i
ON pdi.pdi_itemid = i.inv_id
WHERE pdi.pdi_playerid = '".mysql_real_escape_string($_GET['ID'])."'
ORDER BY i.inv_id ASC");
echo "<table width = '100%' cellspacing='1'><tr>";
if(!$db->num_rows($thishop))
{
echo "<tr><td align = 'center'>This person does not have any items in their display case.</td></tr></table>";
}
else
{
$ts = array();
$num = 0;
while($ts = $db->fetch_row($thishop))
{
$num++;
echo "<td align = 'center'><b>",htmlentities($ts['item_name']),"</b>
(x ".number_format($ts['pdi_qty']).")
<a href='iinfo.php?ID=".$ts['item_id']."'><img src='images/items/".$ts['item_picture']."' border='1'></a></td>";
if($num == 3)
{
echo "</tr><tr>";
$num=0;
}
}
echo "</table>";
}
}
}
}
function add()
{
echo "<center><h1>Add items to your display</h1><hr />";
global $ir,$h, $db, $m, $user, $itemid, $qty, $userid, $myshop, $mine, $listem, $le, $_POST, $alin, $ai;
$query = array();
$db->query("SELECT `display_case`
FROM `users`
WHERE `userid` = '".mysql_real_escape_string($ir['userid'])."'
AND `display_case` = 'yes'");
if(!$db->num_rows($myshop))
{
echo "<table>Error, You dont own a display case to add items to!<br/>
<hr width='750px'>><a href=\"javascript:history.back();\">Back</a><hr width='750px'></table>";
$h->endpage();
exit();
}
if(!$_POST['add'])
{
$query = array();
$db->query("SELECT * FROM `inventory` mi
LEFT JOIN `items` i
ON mi.inv_itemid = i.itmid
WHERE mi.inv_userid = '".$ir['userid']."'");
$listem = array();
$listem = $db->query($q_ry);
$le = array();
echo "<table width = '750px' class = 'rounded'><tr><td align = 'center'>
<table width = '100%'><tr bgcolor = #999999 style = 'font-weight:800;'><td>Item</td><td>Qty</td><td>Add</td>
</tr>";
$num=0;
while($le = $db->fetch_row($listem))
{
echo "<form action = 'display.php?action=add' method = 'post'>
<tr bgcolor = $color>
<td align = 'left'>".htmlentities($le['itmname'])."</td>
<td align = 'left'>".number_format($le['inv_qty'])."</td>
<td align = 'right'><input type = 'text' name = 'qty' value = ''>
<input type = 'hidden' name = 'item' value = '".$le['inv_id']."'>
<input type = 'submit' name = 'add' value = 'Add'></td></tr></form>";
}
echo "</table></td></tr></table>";
}
else
{
$_POST['inv_id'] = abs(intval($_POST['inv_id']));
$_POST['inv_qty'] = abs(intval($_POST['inv_qty']));
if(!$_POST['item'] || !$_POST['qty'])
{
echo "<table>Error, Please go back and fill the form in correctly!<br/>
<hr width='750px'>><a href='display.php?action=add'>Back</a><hr width='750px'></table>";
$h->endpage();
exit();
}
$query = array();
/* Do some more filtering and sanitation on inputs, please - sniko */
$mine = $db->query("SELECT `inv_itemid` FROM `inventory` WHERE (`inv_itemid`= '". $_POST['item'] ."') AND (`inv_userid` = '". $userid ."'");
$mine = array();
$mine = $db->query($q_ry);
if(!$db->num_rows($mine))
{
echo "<table>Error, Invalid item!<br/>
<hr width='750px'>><a href='display.php?action=add'>Back</a><hr></table>";
$h->endpage();
exit();
}
$m = array();
$m = $db->fetch_row($mine);
if($_POST['qty'] > $m['inv_qty'])
{
echo "<table>Error, you dont have that many!<br/>
<hr width='750px'>><a href='display.php?action=add'>Back</a><hr width='750px'></table>";
$h->endpage();
exit();
}
if($_POST['item'] && $_POST['qty'] && $_POST['add'] != 'Confirm')
{
echo "<table>Are you sure you wish to add ".number_format($_POST['qty'])." <b>".htmlentities($m['itmname'])."(s)</b> to your display?<br/>
<form action = 'display.php?action=add' method = 'post'>
<input type = 'hidden' name = 'item' value = '".$_POST['item']."'>
<input type = 'hidden' name = 'qty' value = '".$_POST['qty']."'>
<input type = 'submit' name = 'add' value = 'Confirm'>
</form></table>";
}
else
{
if($_POST['item'] && $_POST['qty'] && $_POST['add'] == 'Confirm')
{
$query = array();
$db->query("SELECT *
FROM `player_display_items`
WHERE `pdi_itemid` = '".($ir['item_id'])."'
AND `pdi_playerid` = '".($ir['userid'])."'");
if(!$db->num_rows($alin))
{
$query = array();
$db->query("INSERT INTO `player_display_items`
VALUES ('NULL',
'".($ir['userid'])."',
'".($ir['item_id'])."',
'".($_POST['qty'])."')");
}
else
{
$query = array();
$db->query("UPDATE `player_display_items`
SET `pdi_qty` = `pdi_qty` + '".mysql_real_escape_string($_POST['qty'])."'
WHERE `pdi_id` = '".mysql_real_escape_string($ai['pdi_id'])."'");
}
$itemid = 1; //id of the item here
$qty = 1; //amount to remove
item_remove($userid, $itemid, $qty);
echo "Items added successfully!
<hr width='750px'>><a href='display.php?action=add'>Okay</a><hr width='750px'>";
$h->endpage();
exit();
}
}
}
}
function remove()
{
echo "<center><main>Remove items from your display</main><hr width = '750px'>";
global $ir,$h ;
$query = array();
$db->query("SELECT `display_case`
FROM `users_extra`
WHERE `playerid` = '".mysql_real_escape_string($ir['userid'])."'
AND `display_case` = 'yes'");
$myshop = array();
$myshop = $db->query($q_ry);
if(!$db->num_rows($myshop))
{
echo "Error, You dont own a display case to add items to!<br/>
<hr width='750px'>><a href=\"javascript:history.back();\">Back</a><hr width='750px'>";
$h->endpage();
exit();
}
$query = array();
$db->query("SELECT *
FROM `player_display_items` pdi
LEFT JOIN `items` i
ON pdi.pdi_itemid = i.inv_id
WHERE pdi.pdi_playerid = '".mysql_real_escape_string($ir['userid'])."'");
$instock = array();
$instock = $db->query($q_ry);
echo "<table width = '750px' class = 'rounded'>";
if(!$db->num_rows($instock))
{
echo "<tr><td align = 'center'>You dont have any items to remove.</td></tr></table>";
}
else
{
if(!$_POST['remove'])
{
echo "<tr bgcolor = #999999 style = 'font-weight:800;'>
<td align = 'left'>Item</td>
<td align = 'left'>Qty</td>
<td align = 'left'>Remove</td>
</tr>";
$num = 0;
$is = array();
while($is = $db->fetch_row($instock))
{
$num++;
$odd="#D8D8D8";
$even="#e3e3e3";
if ($num % 2) {
$color="$even";
} else {
$color="$odd";
}
echo "<form action = 'display.php?action=remove' method = 'post'>
<tr bgcolor = $color><td align = 'left'>",htmlentities($is['item_name']),"</td>
<td align = 'left'>".$is['pdi_qty']."</td>
<td align = 'center'>
<input type = 'hidden' name = 'item' value = '".$is['pdi_id']."'>
<input type = 'submit' name = 'remove' value = 'Remove'></td></tr></form>";
}
}
else
{
$_POST['item'] = abs(intval($_POST['item']));
if(!$_POST['item'])
{
echo "Error, Invalid item to remove!<br/>
<hr width='750px'>><a href='index.php'>Back</a><hr width='750px'>";
$h->endpage();
exit();
}
else
{
$query = array();
$db->query("SELECT *
FROM `player_display_items`
WHERE `pdi_playerid` = '".mysql_real_escape_string($ir['userid'])."'
AND `pdi_id` = '".mysql_real_escape_string($_POST['item'])."'");
$myitem = array();
$myitem = $db->query($q_ry);
if(!$db->num_rows($myitem))
{
echo "Error, Invalid item to remove!<br/>
<hr width='750px'>><a href='index.php'>Back</a><hr width='750px'>";
$h->endpage();
exit();
}
else
{
$mi = array();
$mi = $db->fetch_row($myitem);
item_add($ir['userid'], $mi['pdi_itemid'], $mi['pdi_qty']);
$query = array();
$db->query("DELETE FROM `player_display_items`
WHERE `pdi_id` = '".mysql_real_escape_string($_POST['item'])."'");
$db->query($q_ry);
echo "Your item(s) were returned to you, You may now do as you wish with them.";
}
}
}
echo "</table>";
}
}
echo "<hr width='750px'>><a href='index.php'>Back</a><hr width='750px'>";
$h->endpage();
?>
