<?php


session_start();

if (isset($_POST['login']) && isset($_POST['pass']) && $_POST['login'] == "constans" && $_POST['pass'] == "arz123@#!") {
	$_SESSION['logged'] = true;
}

if (isset($_SESSION['logged'])) {
?>
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title>Panel Administracyjny</title>
<script>
  (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
  (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
  m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
  })(window,document,'script','https://www.google-analytics.com/analytics.js','ga');

  ga('create', 'UA-78046649-1', 'auto');
  ga('send', 'pageview');

</script>
</head>
<body>
<?php

    include('config.php');

    $con = mysqli_connect($host, $user, $pass, $base);
    if (mysqli_connect_errno()) die (mysqli_connect_error());

    if (!$con->set_charset("utf8")) {
	    printf("Error loading character set utf8: %s\n", $mysqli->error);
    }

    function escape_for_query($con, $query) {
	$escaped = $con->real_escape_string($query);
	$more_escaped = addcslashes($escaped, '%_');
	return $more_escaped;
    }

    function lista($con) {
        $query = "SELECT *,unix_timestamp(data) FROM aktualnosci ORDER BY id DESC";
        $result = mysqli_query($con, $query);
        while ($result && $row = mysqli_fetch_array($result)) {

            $mysqldate = date("d m Y", $row['unix_timestamp(data)']);

            echo "<hr />";
            echo $mysqldate . "<br />";
            echo $row['tytul'] . "<br />";
?>
<form action="admin.php" method="post">
<input type="hidden" name="action" value="edit">
<input type="hidden" name="id" value="<?php echo $row['id']; ?>">
<input type="submit" value="Edytuj">
</form>
<form action="admin.php" method="post">
<input type="hidden" name="action" value="remove">
<input type="hidden" name="id" value="<?php echo $row['id']; ?>">
<input type="submit" value="Usuń">
</form>
<?php

        }
    }

    $action = escape_for_query($con, $_POST['action']);
    $id = escape_for_query($con, $_POST['id']);

?>
<a href="./admin.php">Wróć do listy</a><br />
<?php

    if ($action === "add") {
        /* wsadź nowe */
        $tytul = escape_for_query($con, $_POST['tytul']);
        $wiadomosc = escape_for_query($con, $_POST['wiadomosc']);

	$query = "INSERT INTO aktualnosci VALUES (DEFAULT, NOW(), '" . $tytul . "', '" . $wiadomosc. "')";
	$result = mysqli_query($con, $query) or die(mysqli_error($con));

        lista($con);
    } elseif ($action === "edit") {
        /* pole do edycji */
        $query = "SELECT * FROM aktualnosci WHERE id=" . $id;
        $result = mysqli_query($con, $query);
        while ($result && $row = mysqli_fetch_array($result)) {

?>
<form action="admin.php" method="post">
<input type="hidden" name="action" value="update">
<input type="hidden" name="id" value="<?php echo $row['id']; ?>">
Tytuł: <input type="text" name="tytul" value="<?php echo $row['tytul']; ?>"><br />
Wiadomość: <textarea name="wiadomosc" rows="24" cols="80"><?php echo $row['wiadomosc']; ?></textarea>
<input type="submit" value="Wyślij">
</form>
<?php

        }
    } elseif ($action === "update") {
        /* wsadź zaktualizowane */
        $tytul = escape_for_query($con, $_POST['tytul']);
        $wiadomosc = escape_for_query($con, $_POST['wiadomosc']);

	$query = "UPDATE aktualnosci SET tytul='" . $tytul. "', wiadomosc='" . $wiadomosc. "' WHERE id='" . $id . "'";
	$result = mysqli_query($con, $query) or die(mysqli_error($con));

        lista($con);
    } elseif ($action === "remove") {
        /* potwierdź */
?>
POTWIERDŹ, ŻE CHCESZ USUNĄĆ
<form action="admin.php" method="post">
<input type="hidden" name="action" value="delete">
<input type="hidden" name="id" value="<?php echo $id; ?>">
<input type="submit" value="USUŃ!">
</form>
<?php
    } elseif ($action === "delete") {
        /* wyślij w kosmos */

        $query = "DELETE FROM aktualnosci WHERE id='" . $id . "'";
	$result = mysqli_query($con, $query) or die(mysqli_error($con));

        lista($con);
    } else {
?>
<form action="admin.php" method="post">
<input type="hidden" name="action" value="add">
Tytuł: <input type="text" name="tytul"><br />
Wiadomość: <textarea name="wiadomosc" rows="24" cols="80"></textarea>
<input type="submit" value="Wyślij">
</form>
<?php
        lista($con);
    }

?>
</form>
</body>
</html>
<?php
} else { 
?>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title>Panel Administracyjny</title>
</head>
<body>
<form action="./admin.php" method="post">
Login: <input type="text" name="login" /><br />
Hasło: <input type="password" name="pass" /><br />
<input type="submit" value="Zaloguj"/>
</form>
</body>
</html>
<?php
}
?>
