<?php
/*
This file allowes user to edit their account
*/
session_start();
require_once("includes/mysql_login.php");
if(!isset($_SESSION['autheticate']))
{
	header("Location: index.php");
	exit;
}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>IEEE Student Chapter| Short Posts </title>
<link rel="stylesheet" href="includes/style.css" type="text/css" /></head>
<body>
<?php 
include("header.htm");
echo "<div class=left>";
include("includes/left.htm");
echo "</div>";
?>
<?php
echo "<div class=body>";
$userid = $_GET[userid];
$user_row = "SELECT * FROM `user` where identification = $userid";
$user_row_query = mysql_query($user_row);
if(!isset($_POST[edit_account]))
{
	while ($user_row_query_result = mysql_fetch_array($user_row_query))
	{
			echo "<table>";
			echo "<tr>";
			echo "<td>";
			echo "<h3>Update your account</h3>";
			echo "<form action=\"$PHP_SELF\" method=\"POST\">";
			echo "Username:<dd><input type = text name = editusername ></dd><br> <br>";
			echo "E-mail:<dd><input type = text name = editemail ></dd><br> <br>";
			echo "Name:<dd><input type = text name = editname ></dd><br> <br>";
			echo "Old Password: <dd><input type = password name = oldpasswd></dd><br><br>";
			echo "New Password: <dd><input type = password name = newpasswd></dd><br>";
			echo "<input type = submit name = edit_account value = Edit >";
			echo "</form>";
			echo "</td>";
			echo "<td>";
			echo "<h3>&nbsp;&nbsp;&nbsp;Your Existing Account Summary</h3> <br>";
			echo " <dd>Username: $user_row_query_result[username]</dd><br><br>";
			echo " <dd> E-mail: $user_row_query_result[email]</dd><br><br>";
			echo " <dd>Name: $user_row_query_result[name] </dd><br><br>";
			echo " <dd>Date: $user_row_query_result[date_created]</dd> <br>";
			echo "<dd>&nbsp;</dd> <br><br>";
			echo "<dd>&nbsp;</dd><br><br><br>";
			echo ",<dd> &nbsp;</dd><br><br>";
			echo "</td>";
			echo "</tr>";
			echo "</table>";
	}
  } else
  {
  			$oldpass = md5($_POST['oldpasswd']);
			$result = mysql_query("SELECT * FROM user WHERE password='$oldpass'") or die("Couldn't query the user-database.");
			$row_user = mysql_fetch_array($result);
			$num = mysql_result($result, 0); 
			if(!$num)
			{
				echo "Your old password did not math. Try again! ";
			} else
			{
				validate_user_input();
			}		
  }
/*
Before storing on the MySQL validate the user input.
*/
  function validate_user_input()
  {
  			$username = mysql_real_escape_string(trim($_POST['editusername']));
			$password = mysql_real_escape_string(trim($_POST['newpasswd']));
			$email = mysql_real_escape_string(trim($_POST['editemail']));
			$name = mysql_real_escape_string(trim($_POST['editname']));
			$errors = array();
			if(($username == "")||(strlen($username)>50))
			{
				$errors[] = " Your username field is either blank or longer then 50 charecters.";
			}
			if(($password == "")||(strlen($password)>50))
			{
				$errors[] = " Your password field is either blank or longer then 50 charecters.  ";
			}
			if(($email == "")||(strlen($email)>50))
			{
				$errors[] = " Your email field is either blank or longer then 50 charecters.";
			}
			if(empty($errors))
			{
			check_domain();
			} else 
			{
				foreach ($errors as $error) 
				{
					echo "- ". $error; 
					echo "<br>";
				}
				echo "<meta http-equiv = \"refresh\" content = \"2; URL=edit_account.php?userid=$_GET[userid]\">";
				echo "<br> Try again! ";
			}
  }
 
/*
Check the domain of the e-mail not to allow user to put false domain. File that checks the false domain is stored on /includes/emailvarification.php. 
*/
function check_domain()
	{
	$email = mysql_real_escape_string(trim($_POST['editemail']));
	include("includes/emailvarification.php");
	}
/*
If information is valid store on the MySQL
*/
function dump_info_mysql()
{
		$userid = $_GET[userid] . "is User Id ";
		$username = mysql_real_escape_string(trim($_POST['editusername']));
		$password = mysql_real_escape_string(trim($_POST['newpasswd']));
		$email = mysql_real_escape_string(trim($_POST['editemail']));
		$name = mysql_real_escape_string(trim($_POST['editname']));
		$edit_user = "UPDATE `user` SET username = '$username', password = md5('$password'), 
						email = '$email', name = '$name', date_created = now() where identification = '$userid'";
		$edit_user_result = mysql_query($edit_user);
		if(!$edit_user_result)
		{
			echo "<br> Error on updating your account . " . mysql_error();
		} else
		{
			echo "Your account has been updated " ; 
			echo "<b> Page will automatically re-direct to index page in 2 seconds </b> <br>";
			echo "<a href = index.php>Click here</a>if you have problem on loading";
			echo "<meta http-equiv = \"refresh\" content = \"2; URL=index.php\">";

		}
}
echo "</div>";
?>
</body>
</html>
<?php
flush();
include("bottom.htm");
?>