CREATE TABLE IF NOT EXISTS cms_section (
  section_id int(4) unsigned NOT NULL auto_increment COMMENT 'The unique ID of the section',  
  is_published tinyint(1) NOT NULL default '0',
  section_name varchar(20) NULL COMMENT 'The section name',
  section_parent_id int(4) NULL DEFAULT 0 COMMENT 'The ID of the parent section',  
  author_id int(11) NOT NULL default '0',
  PRIMARY KEY (section_id)
)TYPE=MyISAM;

CREATE TABLE IF NOT EXISTS cms_articles (
  article_id int(11) NOT NULL auto_increment,  
  section_id int(4) unsigned NOT NULL default '0' COMMENT 'Relation to section',
  author_id int(11) NOT NULL default '0',
  is_published tinyint(1) NOT NULL default '0',
  date_submitted datetime NOT NULL default '0000-00-00 00:00:00',
  date_published datetime NOT NULL default '0000-00-00 00:00:00',
  title varchar(255) NOT NULL default '',
  body mediumtext NOT NULL,
  PRIMARY KEY (article_id),
  KEY IdxArticle (author_id,date_submitted),
  FULLTEXT KEY IdxText (title,body)
)
  TYPE = MyISAM

<?php

require_once 'conn.php';

$article = '';
$title = '';
$section_id = '';
$body = '';
$author_id = '';
if (isset($_GET['a'])
    and $_GET['a'] == 'edit'
    and isset($_GET['article'])
    and $_GET['article']) {
  $sql = "SELECT ar.* ".
          "FROM cms_articles ar " .

         "WHERE article_id=" . $_GET['article'];
  $result = mysql_query($sql, $conn)
    or die('Could not retrieve article data; ' . mysql_error());

  $row = mysql_fetch_array($result);
  $title = $row['title'];
  $section_id = $row['section_id'];
  $body = $row['body'];
  $article = $_GET['article'];
  $authorid = $row['author_id'];
}
require_once 'header.php';
?>

<form method="post" action="transact-article.php">

<h2>Compose Article</h2>

<p>
  Title:<br>
  <input type="text" class="title" name="title" maxlength="255"
    value="<?php echo htmlspecialchars($title); ?>">
</p>


<p>
Section:<br>
<select id="section_name" name="section_name" style="width:150px">
<?php
$section_name = "";
$sql = "SELECT section_id, section_name " .
         "FROM cms_section ORDER BY section_id";
  $result = mysql_query($sql)
    or die("Query Error" .
           mysql_error());
  while ($row = mysql_fetch_array($result)) {
    if ($row['section_id'] == $section_name) {
      $selected = " selected";
    } else {
      $selected = "";
    }
    echo '<option value="' . $row['section_id'] . '"' . 
         $selected.'>' . $row['section_name'] . '</option>' . 
         "\r\n";
  }

?>
</select>






</p>

<p>
  Body:<br>
  <textarea class="body" name="body" rows="10" cols="60"><?php
    echo htmlspecialchars($body); ?></textarea>
</p>
<p>
<?php
echo '<input type="hidden" name="article" value="' .
     $article . "\">\n"; 

if ($_SESSION['access_lvl'] < 2) {
  echo '<input type="hidden" name="authorid" value="' .
       $authorid . "\">\n";
}

if ($article) {
  echo '<input type="submit" class="submit" name="action" ' .
       "value=\"Save Changes\">\n";
} else {
  echo '<input type="submit" class="submit" name="action" ' .
       "value=\"Submit New Article\">\n";
}
?>
</p>
</form>

<?php require_once 'footer.php'; ?>

<?php
session_start();
require_once 'conn.php';
require_once 'http.php';

if (isset($_REQUEST['action'])) {
  switch ($_REQUEST['action']) {
    case 'Submit New Article':
      if (isset($_POST['title'])
          and isset($_POST['section_id'])
          and isset($_POST['body'])
          and isset($_SESSION['user_id']))
      {
        $sql = "INSERT INTO cms_articles " .
               "(title,section_id,body,author_id,date_submitted) " .
               "VALUES ('" . $_POST['title'] . 
               "','" . $_POST['section_id'] . 
               "','" . $_POST['body'] .
               "'," . $_SESSION['user_id'] . ",'" .
               date("Y-m-d H:i:s", time()) . "')";



        mysql_query($sql, $conn)
          or die('Could not submit article; ' . mysql_error());
      }
      redirect('index.php');
      break;

    case 'Edit':
      redirect('compose.php?a=edit&article=' . $_POST['article']);
      break;

    case 'Save Changes':
      if (isset($_POST['title'])
          and isset($_POST['section_id'])
          and isset($_POST['body'])
          and isset($_POST['article']))
      {
        $sql = "UPDATE cms_articles " .
               "SET title='" . $_POST['title'] .
                "', section_id='" . $_POST['section_id'] .
               "', body='" . $_POST['body'] . "', date_submitted='" .
               date("Y-m-d H:i:s", time()) . "' " .
               "WHERE article_id=" . $_POST['article'];
               if (isset($_POST['authorid'])) {
                 $sql .= " AND author_id=" . $_POST['authorid'];
               }

        mysql_query($sql, $conn)
          or die('Could not update article; ' . mysql_error());
      }

      if (isset($_POST['authorid'])) {
        redirect('cpanel.php');
      } else {
        redirect('pending.php');
      }
      break;

    case 'Publish':
      if ($_POST['article']) {
        $sql = "UPDATE cms_articles " .
               "SET is_published=1, date_published='" .
               date("Y-m-d H:i:s",time()) . "' " . 
               "WHERE article_id=" . $_POST['article'];
        mysql_query($sql, $conn)
          or die('Could not publish article; ' . mysql_error());
      }
      redirect('pending.php');
      break;

    case 'Retract':
      if ($_POST['article']) {
        $sql = "UPDATE cms_articles " .
               "SET is_published=0, date_published='' " .
               "WHERE article_id=" . $_POST['article'];
        mysql_query($sql, $conn)
          or die('Could not retract article; ' . mysql_error());
      }
      redirect('pending.php');
      break;

    case 'Delete':
      if ($_POST['article']) {
        $sql = "DELETE FROM cms_articles " .
               "WHERE is_published=0 " . 
               "AND article_id=" . $_POST['article'];
        mysql_query($sql, $conn)
          or die('Could not delete article; ' . mysql_error());
      }
      redirect('pending.php');
      break;

    case 'Submit Comment':
      if (isset($_POST['article'])
          and $_POST['article']
          and isset($_POST['comment'])
          and $_POST['comment'])
      {
        $sql = "INSERT INTO cms_comments " .
               "(article_id,comment_date,comment_user,comment) " .
               "VALUES (" . $_POST['article'] . ",'" .
               date("Y-m-d H:i:s", time()) . 
               "'," . $_SESSION['user_id'] .
               ",'" . $_POST['comment'] . "')";
        mysql_query($sql, $conn)
          or die('Could add comment; ' . mysql_error());
      }
      redirect('viewarticle.php?article=' . $_POST['article']);
      break;

    case 'remove':
      if (isset($_GET['article'])
          and isset($_SESSION['user_id']))
      {
        $sql = "DELETE FROM cms_articles " .
               "WHERE article_id=" . $_GET['article'] . 
               " AND author_id=" . $_SESSION['user_id'];
        mysql_query($sql, $conn)
          or die('Could not remove article; ' . mysql_error());
      }
      redirect('cpanel.php');
      break;
  }
} else {
  redirect('index.php');
}
?>