<?php
function renderForm($titolo, $testo, $chi, $cat, $error)
{$er_col_chi = "#000000";
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Nuova News</title>
</head>
<body>
<h1><CENTER>AGGIUNGI UNA NUOVA NEWS</CENTER></h1>
<?php
if ($error != '')
{
echo '<div style="padding:4px; border:1px solid red; color:red;">'.$error.'</div>';
}
?>
<center>
<form action="" method="post" >
<div>
<p><br/>
<br/>
<br/>
</p>
<table width="50%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="75"><strong>Titolo: *</strong></td>
<td width="735"><input type="text" name="titolo" value="<?php echo $titolo; ?>" /></td>
</tr>
<tr>
<td><strong>Testo: *</strong></td>
<td><textarea name="testo" id="ckeditor" rows="10" ><?php echo $testo; ?></textarea></td>
</tr>
<tr>
<td><strong>Autore: *</strong></td>
<td><input type="text" name="chi" readonly="true" value="<?php echo $_SESSION['user']; ?>" ></td>
</tr>
<tr>
<td><strong>Categoria: *</strong></td>
<td><select name="cat">
<script>
<textarea id="editor1"> with a CKEditor
CKEDITOR.replace( 'ckeditor' );
</script>
<?php
require('db.php');
while($ris_cat = mysql_fetch_array($categorie))
{
$nome_cat = '<option value="' . $ris_cat['Nome'] . '" >' . $ris_cat['Nome'] . '</option>';
echo $nome_cat;
}
?>
</select>
</td>
</tr>
<tr>
<td>* obligatori</td>
<td> </td>
</tr>
<tr>
<td> </td>
<td><input type="submit" name="submit" value="Invia"></td>
</tr>
</table>
<p> </p>
</div>
<?php
}
include('db.php');
if (isset($_POST['submit']))
{
$cerca = array("à" , "ì" , "è" , "é" , "ò" , "ù");
$modifica = array("à" , "ì" , "é" , "è" , "ó" , "ú");
$titolo = mysql_real_escape_string(str_replace($modifica, $cerca ,$_POST['titolo']));
$testo = mysql_real_escape_string(str_replace($modifica, $cerca ,$_POST['testo']));
$chi = mysql_real_escape_string(str_replace($modifica, $cerca ,$_POST['chi']));
$cat = mysql_real_escape_string(str_replace($modifica, $cerca ,$_POST['cat']));
$quando=date('Y-m-d', time());
if ($titolo == '' || $testo == '' || $chi == '' || $cat == '')
{
$error = 'ERRORE: Completa tutti i campi!';
renderForm($titolo, $testo, $chi, $cat, $error);
}
else
{
mysqli_query($connection, "INSERT news SET titolo='$titolo', testo='$testo', chi='$chi', quando='$quando', cat='$cat'")
or die(mysqli_error());
header("Location: vedi.php");
}
}
else
{
renderForm('','','','','');
}
?>
</body>
</html>