<?php
header('Content-Language:en');
session_start();
ini_set( "display_errors", 0);
if (isset($_POST['go'])) {
	if ((isset($_POST['auteur'])) && (isset($_POST['message']))) {
		if ((!empty($_POST['auteur'])) && (!empty($_POST['message']))) {
			if (strlen($_POST['auteur']) < 80 && strlen($_POST['message']) < 800) {
				if (strtolower(trim($_POST['cle'])) == "cold" && $_POST['cle'] != "") {
					// on se connecte à notre base
					include("sql.php");
					$base = mysql_connect ($sqlserver, $sqllogin, $sqlpass);
					mysql_select_db ($sqlbase, $base);
					$limite = mysql_fetch_array(mysql_query('SELECT COUNT(*) FROM livre_or WHERE ip="'.$_SERVER['REMOTE_ADDR'].'" AND date_signature > SUBTIME(now(),"0:05")'));
					if ($limite[0] > 1) {
						$erreur = 'You have already sent too many signatures!';
					} else {
						// on prepare notre requête d'insertion des données
						$sql = 'INSERT INTO livre_or VALUES("", "'.mysql_escape_string($_POST['auteur']).'", "'.mysql_escape_string($_SERVER['REMOTE_ADDR']).'", "'.date("Y-m-d H:i:s").'", "'.mysql_escape_string($_POST['message']).'", "en")';
						// on lance la requête
						mysql_query($sql) or $erreur='Failed to send to the database.';
					}
					// on ferme la connexion à la base de données
					mysql_close();
				} else {
					$erreur = 'You did not answer the question correctly. Please try again.';
				}
			} else {
				$erreur = 'Your message could not be sent because it is too long (> 800 characters).';
			}
		} else {
			$erreur = 'Please fill in all fields.';
		}
	} else {
		$erreur = 'Error: variables are not defined.';
	}
}
?>
<!DOCTYPE html>
<html>
	<head>
		<meta http-equiv="X-UA-Compatible" content="IE=Edge" >
		<meta http-equiv="Content-Type" content="text/html;charset=utf-8" >
		<title>Guestbook — Jumpman and Robinhood’s domain</title>
		<link rel="stylesheet" href="style.css">
	</head>
	<body>
      <?php require("menu.php.en");?>
		<div id="contenu">
		<h2>Guestbook</h2>
		<?php
		if (isset($erreur) || !isset($_POST['go'])) {
			if (isset($erreur)) echo '<p class="warning">',$erreur,'</p>';
			else echo '<p>You can sign our guestbook to acknowledge your visitation to the site. We are eager for what you have to say about our videos!
			Thank you for your support.</p>';
			?>
			<form action="" method="post">
				<p><input type="text" name="auteur" maxlength="80" size="50" value="<?php if (isset($_POST['auteur'])) echo stripslashes(htmlentities(trim($_POST['auteur']), ENT_QUOTES, "UTF-8")); else echo 'Author" onfocus="if (this.value==\'Author\') this.value=\'\';this.onfocus=\'\'' ?>" placeholder="Author">
				<p><textarea name="message" cols="50" rows="10" placeholder="Message" <?php if (!isset($_POST['message'])) echo 'onfocus="if (this.value==\'Message\') this.value=\'\'; this.onfocus=\'\'"';?>><?php if (isset($_POST['message'])) echo stripslashes(htmlentities(trim($_POST['message']), ENT_QUOTES, "UTF-8")); else echo 'Message'?></textarea>
				<p>Security: please answer the question below to prove you are human.<br>
				<em>What is the opposite of “hot”?</em> <input class="captcha" type="text" name="cle" size="10"/>
				<p><input type="submit" name="go" value="Sign guestbook"></p>
			</form>
			<?php 
		} else {
			echo '<p>Your signature has been added to the list below.</p>';
		}
		unset($erreur);?>
		<h3>Signatures</h3>
		<div id="signatures">
			<?php include("sql.php");
			$base = mysql_connect ($sqlserver, $sqllogin, $sqlpass);
			mysql_select_db ($sqlbase, $base);
			mysql_query('DELETE FROM livre_or WHERE ip=""') or ('');
			$sql = 'SELECT auteur, date_signature, message, langue FROM livre_or ORDER BY date_signature DESC';
			$req = mysql_query($sql) or $erreur = 'SQL database error.';
			
			$nb_signature = mysql_num_rows($req);
			
			if ($nb_signature == 0 && !isset($erreur)) {
				echo '<p>No entry.';
			} else if (isset($erreur)) {
				echo '<p class="warning">'.$erreur;
			} else {
				while ($data = mysql_fetch_array($req)) {
					$meridiem = "am";
					sscanf($data['date_signature'], "%4s-%2s-%2s %2s:%2s:%2s", $annee, $mois, $jour, $heure, $minute, $seconde);
					if ($heure > 12) {
						$heure -= 12;
						$meridiem = "pm";
					}
					$langImg = '';
					if ($data['langue'] == 'fr')
					{
						$langImg = 'src="flag-fr.png" title="Message sent from the French version of this site" alt="[French]"';
					}
					else if ($data['langue'] == 'en')
					{
						$langImg = 'src="flag-en.png" title="Message sent from the English version of this site" alt="[English]"';
					}					
					echo '<div class="message"><p><span class="auteur">' , stripslashes(htmlentities(trim($data['auteur']), ENT_QUOTES, "UTF-8"));
					echo '</span> <span class="date">(' , $mois , '/' , $jour , '/' , $annee , ' at ' , $heure , ':' , $minute , ' ', $meridiem, ')</span> <img class="message_flag" '.$langImg.'><br>';
					echo nl2br(stripslashes(htmlentities(trim($data['message']), ENT_QUOTES, "UTF-8"))), '</p>';
					echo '</div>';
				}
			}
			mysql_free_result ($req);
			mysql_close ();
			?>
			</div>
		</div>
	</body>
</html>