1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

// Bejövő levelek olvasása
if ($action == "read_inbox")
{
  $id = (int)$_GET["id"];
  if (!int_check($id)) {
      exit("Érvénytelen ID.");
  }
 
  $res = mysql_query("SELECT l.id, l.added, l.msg, l.sender, l.unread, l.location, u.username FROM letters l
                      LEFT JOIN users u ON u.id = l.sender 
                                        WHERE l.receiver = ".sqlesc($CURUSER["id"])." AND l.location = 'in' ORDER BY l.added DESC") or die("barf!");
  $arr = mysql_fetch_assoc($res);
  
  if ($arr["unread"] == "yes") {
      mysql_query("UPDATE letters SET unread = 'no' WHERE id=".(int)$arr["id"]) OR die("Hiba történt az adatbázis módosítása során!");
    }
 
  
  stdhead("Bejövő");
  echo ("<table width='700' align='center' cellspacing='0' cellpadding='0'><tr><td>");
  echo ("<div class='letters'>".$arr["msg"]."<br />Dátum: ".date("H:i", $arr["added"])."</div>");
  echo ("<a href='$BASEURL/messages.php?action=send_form&amp;id=".(int)$arr["sender"]."'>Válasz</a><br />
         <a href='$BASEURL/messages.php?action=delete&amp;id=".(int)$arr["id"]."&amp;type=in'>Törlés</a>
         <br /><a href='$BASEURL/messages.php?action=view_inbox'>Bejövő</a>");
  echo ("</td></tr></table><hr class='hr' />");
  stdfoot();
}
 

1

<a href='$BASEURL/messages.php?action=send_form&amp;id=$id'>Üzenet</a>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

$action = htmlsafechars($_GET["action"]);
 
if ($action == "send_form")
{
  $id = (int)$_GET["id"];
  if (!int_check($id)) {
      exit("Érvénytelen ID.");
  }
 
    $res = mysql_query("SELECT u.id, u.username FROM users u WHERE u.id = ".sqlesc($id));
  $user = mysql_fetch_assoc($res);
  
  stdhead("Üzenet küldés");
  
  echo ("Címzett: ".$user["username"]."");
  echo ("<form action='messages.php' method='post'>
        <input type='hidden' name='action' value='take_send' />
        <input type='hidden' name='sender' value='".(int)$CURUSER["id"]."' />
        <input type='hidden' name='receiver' value='$id' />");
        if (isset($_GET["returnto"]) || isset($_SERVER["HTTP_REFERER"])) { ?>
            <input type="hidden" name="returnto" value="<?=(isset($_GET["returnto"]) ? $_GET["returnto"] : $_SERVER["HTTP_REFERER"])?>" />
          <? } 
        echo ("Szöveg:<br /><input type='text' name='message' maxlength='255' /><br />
        <input type='checkbox' name='save' value='yes' />Üzenet mentése<br />
        <input type='submit' value='OK' />");
 
  echo("<hr class='hr'>");
  echo("<a href='$BASEURL/rooms.php'>Szobák</a>&nbsp;|&nbsp;<a href='$BASEURL/menu.php'>Menü</a>");
  stdfoot();
}
 
if ($action == "take_send")
{
  
  $sender = (int)$_POST["sender"];
  $receiver = (int)$_POST["receiver"];
  $added = time();
  $message = htmlsafechars($_POST["message"]);
  
  $save = htmlsafechars($_POST["save"]);
  $location = ($save == 'yes') ? "both" : "in";
 
  $returnto = isset($_POST["returnto"]) ? $_POST["returnto"] : '';
  
  if (!int_check($sender) || !int_check($receiver)) {
      exit("Érvénytelen ID.");
  }
 
  if (empty($message)) {
      exit("Nem írt üzenetet!");
  }
  
  if (strlen($message) > 255) {
      exit("Az üzenet túl hosszú.");
  }
 
  if (!valid_message($message)) {
    exit ("Érvénytelen üzenet.");
  }
 
  mysql_query("INSERT INTO letters (sender, receiver, added, msg, location)
               VALUES(".sqlesc($sender).", ".sqlesc($receiver).", ".sqlesc($added).", ".sqlesc($message).", ".sqlesc($location).")");
  
  if ($returnto) {
    header ("Refresh: 2; url=$returnto");
    exit("Az üzenet sikeresen elküldve!");
  }
}