1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
<?php
// create table stvari (id integer primary key autoincrement, lastnik, ime, opis, vrednost, omejitev, kol, lokacija, slika, datum default CURRENT_TIMESTAMP);
require_once "h.php";
if (!empty($_REQUEST["src"])) {
header("Content-Type: text/plain");
die(file_get_contents($_SERVER["SCRIPT_FILENAME"]));
}
if ((isset($_REQUEST["prijava"]) && (empty($_SERVER["PHP_AUTH_USER"]) || $auth[$_SERVER['PHP_AUTH_USER']] != $_SERVER['PHP_AUTH_PW'])) || (isset($_SERVER['PHP_AUTH_USER']) && $auth[$_SERVER['PHP_AUTH_USER']] != $_SERVER['PHP_AUTH_PW'])) {
header("WWW-Authenticate: Basic realm=inventar");
header("HTTP/1.0 401 Neprijavljen");
die("401");
}
?>
<style>
table, td, tr, th {
border: 1px solid red;
}
img {
width: 1cm;
}
img:hover {
width: 5cm;
}
</style>
<form>
<input autofocus placeholder="where expression" name=q value="<?= @htmlspecialchars($_REQUEST["q"]) ?>" />
<input type=submit />
</form>
<table>
<?php
if (empty($_SERVER['PHP_AUTH_USER']))
echo "<a href=?prijava=1>prijava</a>";
else
echo "<form method=post><input type=submit name=dodaj value='dodaj stvar kot {$_SERVER['PHP_AUTH_USER']}' /></form>";
$passed = [];
if (!empty($_POST["izbriši"]))
$db->exec("delete from stvari where lastnik = '{$_SERVER["PHP_AUTH_USER"]}' and id = '{$_POST["id"]}'");
if (!empty($_POST["dodaj"]) && !empty($_SERVER["PHP_AUTH_USER"]))
$db->exec("insert into stvari (lastnik) values ('{$_SERVER["PHP_AUTH_USER"]}')");
foreach ($_POST as $k => $v)
if (is_numeric($k)) {
foreach ($_POST as $k2 => $v2) {
$sp = strpos($k2, "" . $k);
if ($sp)
$passed[] = substr($k2, 0, $sp);
}
$par = [];
foreach ($passed as $p) {
if (strpos(strtolower($p), "id") === false)
$par[] = "'" . SQLite3::escapeString($p) . "' = '" . SQLite3::escapeString($_POST[$p . $k]) . "'";
}
$s = "update stvari set " . implode(", ", $par) . " where lastnik='{$_SERVER["PHP_AUTH_USER"]}' and id={$k}";
echo $s;
$db->exec($s);
}
if (!empty($_REQUEST["q"]))
$ret = $ro->query("select * from stvari where " . $_REQUEST["q"] . " order by datum desc");
else
$ret = $ro->query("select * from stvari order by datum desc");
$i = 0;
foreach ($ret as $row) {
if ($i == 0)
foreach ($row as $k => $v)
if ($k != "id" && !is_numeric($k))
echo "<th>$k</th>";
echo "<form method=post><tr>";
foreach ($row as $k => $v) {
if ($k == "id" || is_numeric($k))
continue;
echo "<td id=$k$i>";
$ok = false;
foreach (["input", "name"] as $w)
if (strpos(strtolower($v), $w) === FALSE)
$ok = true;
if ($k == "slika" && !empty($v))
echo "<img src=$v></img>";
if ($k == "lastnik" && $v == @$_SERVER['PHP_AUTH_USER']) {
echo "<input type=submit value=shrani name={$row["id"]} />";
echo "<input type=hidden name=id value={$row["id"]} />";
echo "<input type=submit value=izbriši name=izbriši /></td>";
}
if ($row["lastnik"] == @$_SERVER['PHP_AUTH_USER'] && $k != "lastnik") {
echo "<input name=$k{$row["id"]} value='" . htmlspecialchars($v) . "' />";
} else
if ($row["lastnik"] != @$_SERVER['PHP_AUTH_USER'] && $k != "slika")
echo "$v</td>";
}
echo "</form></tr>";
$i++;
}
|
