Nieuwssysteem fout

= USER_POST) { // The front end functions, accessible to everyone $front = secure($_POST['front'],1); if($front == 'login') { // Log in $user_name = strtolower(secure($_POST['username'],1)); $user_pass = secure($_POST['userpass'],2); if($user_name == '') { $error_text = ERROR_9; } else if($user_pass == '') { $error_text = ERROR_10; } else { list($result) = db_assoc("SELECT user_id,user_name,user_pass,user_role FROM ".SITE_PREFIX."users WHERE user_name='$user_name'"); if (!isset($result['user_id'])) { $error_text = ERROR_11; db_state_flood_add(); } else if(md5($user_pass) == $result['user_pass']) { db_state_set(USER_SESSION,USER_IP,$result['user_id'],$result['user_role'],$result['user_name']); db_state_flood_empty(); back(); } else { $error_text = ERROR_11; db_state_flood_add(); } } } else if($front == 'comment' && SITE_COMMENT && (USER_ID != -1 || SITE_ANONYMOUS)) { if(USER_ID == -1) { $comment_name = strtolower(substr(secure($_POST['commentname'],2),0,20)); } else { $comment_name = USER_NAME; } $user_id = USER_ID; $comment_text = substr(secure($_POST['commentfield'],3),0,1000); $comment_date = DATE; $comment_ip = USER_IP; $item_id = secure($_POST['itemid'],5); if(strlen($comment_name) > 3 && strlen($comment_text) > 3 && $item_id != '') { $query = db_query("INSERT INTO ".SITE_PREFIX."comments (comment_name,user_id,comment_text,comment_date,comment_ip,item_id) VALUES('$comment_name','$user_id','$comment_text','$comment_date','$comment_ip','$item_id')"); $query2 = db_query("UPDATE ".SITE_PREFIX."items SET item_comments=item_comments + 1 WHERE item_id='$item_id'"); $query3 = db_query("UPDATE ".SITE_PREFIX."config SET config_comments=config_comments + 1 WHERE config_id='".URI_CONFIG."'"); db_state_flood_add(); if($query && $query2 && $query3) { back('#last'); } else { $error_text = ERROR_20; } } else { $error_text = ERROR_19; } } else if($front == 'commentmodify') { // Checks if the user has enough rights, if the user is not an administrator the ip from the comment must be the same as the user ip. $comment_id = secure($_POST['commentid'],5); $check = false; if(USER_ID != -1 && USER_ROLE >= 10) { $check = true; } else { list($result) = db_row("SELECT COUNT(1) as n FROM ".SITE_PREFIX."comments WHERE comment_id='$comment_id' AND comment_ip='".USER_IP."'"); if($result[0] == 1) { $check = true; } else { $check = false; } } if($check) { if($comment_id != '') { if(isset($_POST['commentdelete'])) { list($item) = db_row("SELECT item_id FROM ".SITE_PREFIX."comments WHERE comment_id='$comment_id'"); $query = db_query("DELETE FROM ".SITE_PREFIX."comments WHERE comment_id='$comment_id'"); $query2 = db_query("UPDATE ".SITE_PREFIX."items SET

= USER_POST) { // The front end functions, accessible to everyone $front = secure($_POST['front'],1); if($front == 'login') { // Log in $user_name = strtolower(secure($_POST['username'],1)); $user_pass = secure($_POST['userpass'],2); if($user_name == '') { $error_text = ERROR_9; } else if($user_pass == '') { $error_text = ERROR_10; } else { list($result) = db_assoc("SELECT user_id,user_name,user_pass,user_role FROM ".SITE_PREFIX."users WHERE user_name='$user_name'"); if (!isset($result['user_id'])) { $error_text = ERROR_11; db_state_flood_add(); } else if(md5($user_pass) == $result['user_pass']) { db_state_set(USER_SESSION,USER_IP,$result['user_id'],$result['user_role'],$result['user_name']); db_state_flood_empty(); back(); } else { $error_text = ERROR_11; db_state_flood_add(); } } } else if($front == 'comment' && SITE_COMMENT && (USER_ID != -1 || SITE_ANONYMOUS)) { if(USER_ID == -1) { $comment_name = strtolower(substr(secure($_POST['commentname'],2),0,20)); } else { $comment_name = USER_NAME; } $user_id = USER_ID; $comment_text = substr(secure($_POST['commentfield'],3),0,1000); $comment_date = DATE; $comment_ip = USER_IP; $item_id = secure($_POST['itemid'],5); if(strlen($comment_name) > 3 && strlen($comment_text) > 3 && $item_id != '') { $query = db_query("INSERT INTO ".SITE_PREFIX."comments (comment_name,user_id,comment_text,comment_date,comment_ip,item_id) VALUES('$comment_name','$user_id','$comment_text','$comment_date','$comment_ip','$item_id')"); $query2 = db_query("UPDATE ".SITE_PREFIX."items SET item_comments=item_comments + 1 WHERE item_id='$item_id'"); $query3 = db_query("UPDATE ".SITE_PREFIX."config SET config_comments=config_comments + 1 WHERE config_id='".URI_CONFIG."'"); db_state_flood_add(); if($query && $query2 && $query3) { back('#last'); } else { $error_text = ERROR_20; } } else { $error_text = ERROR_19; } } else if($front == 'commentmodify') { // Checks if the user has enough rights, if the user is not an administrator the ip from the comment must be the same as the user ip. $comment_id = secure($_POST['commentid'],5); $check = false; if(USER_ID != -1 && USER_ROLE >= 10) { $check = true; } else { list($result) = db_row("SELECT COUNT(1) as n FROM ".SITE_PREFIX."comments WHERE comment_id='$comment_id' AND comment_ip='".USER_IP."'"); if($result[0] == 1) { $check = true; } else { $check = false; } } if($check) { if($comment_id != '') { if(isset($_POST['commentdelete'])) { list($item) = db_row("SELECT item_id FROM ".SITE_PREFIX."comments WHERE comment_id='$comment_id'"); $query = db_query("DELETE FROM ".SITE_PREFIX."comments WHERE comment_id='$comment_id'"); $query2 = db_query("UPDATE ".SITE_PREFIX."items SET