<?php
/*
* @author Istvan Franko
* @copyright 2014
*/

session_start();
if (isset($_SESSION['adminlogin'])){
	//user in logged in. Show a message on the screen
} else {
	//redirect the user to the login form.
	session_destroy();
	header('Location: index.php');
}
?>

<html>

<head>
<title>Natty Notebooks Inc.</title>
<link rel="stylesheet" type="text/css" href="css/style.css" />
</head>

<body>

<div id="container">

<div id="header">
	<! header picture in css >
</div>
	
<div id="navigation">
	<?php include 'admin-nav-bar.php'; ?>
</div>

<div id="aside">	
	<!--Link for navigation-->
	<a href="admin.php"><p style="text-align:center">Back to list</a></p>	
	
	<fieldset style="width:85%"><legend>HELP</legend>
	<p>You can see this page only if you added a new item to our shop.</p> 
	</fieldset><br>
</div>

<div id="content">

<fieldset style="width:95%"><legend>ITEM INSERTED</legend>

<?php

$con = mysql_connect("localhost","*****","*****");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}

mysql_select_db("university", $con);


//get  the values posted from the form (i.e. what user entered in the form) and add them to local variables

$ItemName = test_input($_POST["ItemName"]);
$ItemInMbro = test_input($_POST["ItemInMbro"]);
$ItemInStockton = test_input($_POST["ItemInStockton"]);
$ItemAvailable = test_input($_POST["ItemAvailable"]);
$ItemSpecialOffer = test_input($_POST["ItemSpecialOffer"]);
$ItemPrice = test_input($_POST["ItemPrice"]);
$ItemCategory = test_input($_POST["ItemCategory"]);
$ItemBrand = test_input($_POST["ItemBrand"]);
$ItemModelNum = test_input($_POST["ItemModelNum"]);
$ItemOpSys = test_input($_POST["ItemOpSys"]);
$ItemCpu = test_input($_POST["ItemCpu"]);
$ItemMem = test_input($_POST["ItemMem"]);
$ItemHdd = test_input($_POST["ItemHdd"]);
$ItemScreenSize = test_input($_POST["ItemScreenSize"]);
$ItemShortDesc = test_input($_POST["ItemShortDesc"]);
$ItemDesc = test_input($_POST["ItemDesc"]);
$ItemPicture1 = test_input($_POST["ItemPicture1"]);
$ItemPicture2 = test_input($_POST["ItemPicture2"]);
$ItemPicture3 = test_input($_POST["ItemPicture3"]);
$ItemPicture4 = test_input($_POST["ItemPicture4"]);
$ItemPicture5 = test_input($_POST["ItemPicture5"]);
$ItemOfficialUrl = test_input($_POST["ItemOfficialUrl"]);

function test_input($data)
{
   $data = trim($data);
   $data = stripslashes($data);
   $data = htmlspecialchars($data);
   return $data;
}


//replace single quotes from text field to insert to sql
$ItemShortDesc2 = str_replace("'", "''", $ItemShortDesc);
$ItemDesc2 = str_replace("'", "''", $ItemDesc);

//construct a valid SQL statement that will be send to the database server.
$sql="INSERT INTO natty (ItemName, ItemInMbro, ItemInStockton, ItemAvailable, ItemSpecialOffer, ItemPrice, ItemCategory,
ItemBrand, ItemModelNum, ItemOpSys, ItemCpu, ItemMem, ItemHdd, ItemScreenSize,ItemShortDesc, ItemDesc, 
ItemPicture1, ItemPicture2, ItemPicture3, ItemPicture4, ItemPicture5, ItemOfficialUrl) 
VALUES 
('$ItemName', '$ItemInMbro', '$ItemInStockton', '$ItemAvailable', '$ItemSpecialOffer', '$ItemPrice', '$ItemCategory', '$ItemBrand', 
'$ItemModelNum', '$ItemOpSys', '$ItemCpu', '$ItemMem', '$ItemHdd', '$ItemScreenSize', '$ItemShortDesc2', 
'$ItemDesc2', '$ItemPicture1', '$ItemPicture2', '$ItemPicture3', '$ItemPicture4', '$ItemPicture5', 
'$ItemOfficialUrl')";

//display the SQL we will sent to server -  for debugging only

//echo $sql;

// run the SQL query on the server (i.e. send the SQL to the database server)

if (!mysql_query($sql,$con))
{
die ('Error: ' . mysql_error());
}

echo "<h2>1 record added to the database.</h2>";

//close the connection to the database.

mysql_close($con); 

?>



</fieldset>
</div>

<div id="footer">
<p align="center">Copyright &#169; Istvan Franko, 2014</p>
</div>


</div>
</body
</html>