<?php

if ( ! @include_once( './mainfile.php' ) ) { exit( '!! INCLUDE ERROR. ACCESS DENIED !!' ); }
error_reporting( _E_VALUE );


/* vim: set expandtab tabstop=4 shiftwidth=4: */
// +----------------------------------------------------------------------+
// | myPHPNuke Version 188_8 RC2                                          |
// +----------------------------------------------------------------------+
// | License: GNU/GPL - http://www.gnu.org/copyleft/gpl.html              |
// +----------------------------------------------------------------------+
// | Support: http://myphpnuke.com/                                       |
// +----------------------------------------------------------------------+
// | Author: myPHPNuke Dev Team                                           |
// +----------------------------------------------------------------------+
// | Copyright: © 2001-2004 myPHPNuke Dev Team                            |
// +----------------------------------------------------------------------+
// $Id: reviews.php,v 1.18.2.6 2004/08/17 16:56:26 kirilt Exp $




/*#####################################################################
# MY-PHP-NUKE: Web Portal System REVIEWS
# ======================================
#
# Copyright (c) 2001 by Jeff Lambert (jeffx@qchc.com)
# view example on http://www.qchc.com
#
# This module is for displaying, adding, deleting and modifying REVIEWS
#
#####################################################################*/

//2001-12-09 jeffx:     changed contact information

/*2001-03-29 jeffx:     HTML fix for extrainfo() under Netscape
                        fixed display of index if reviews < 10 /*

/*2001-03-22 jeffx:     HTML fixes in admin/reviews.php
                        added PrintPreview function
                        added SendReview function
                        added ExtraInfo function
                        cleaned up some bad code/*

/*2001-03-19 jeffx:     added function reviews_nav()
                        fixed lots of bad HTML tags
                        removed function alpha()
                        removed 32 excessive functions
                        added search functionality
                        added a show all function
                        added <select> for score in mod
                        removed misleading top5 info*/

/*2001-03-03 hombergs:  Missing translates added.*/

//include("extention.inc");
//if (!IsSet($mainfile)) { include ("mainfile.$phpEx"); }

require_once('class.phpmailer.php');
$mail = new phpmailer();


/* SET MAIL DELIVERY OPTIONS */
$mail->IsHTML(true);
if ($mailmethod == "0") {
    $mail->IsMail();
} else {
    $mail->IsSMTP();
    $mail->Host = $smtp;
}

function reviews_nav($letter, $name)
{
    global $sitename, $uimages,$phpEx;
    echo "<tr><td colspan=\"2\" align=\"center\"><font size=\"4\">";
    if ($letter == "All") {
        echo translate("Listing all reviews in the database");
    } elseif ($letter != "") {
        $help = sprintf(translate("Listing all reviews beginning by <b>%s</b>"),$letter);
        echo "$help";
    } elseif ($name != "") {
        $help = sprintf(translate("Listing all reviews written by <b>%s</b>"),$name);
        echo "$help";
    } else {
        $help = sprintf(translate("Welcome to the Reviews Section of %s"),$sitename);
        echo "$help";
    }
    echo "</font></td></tr><tr><td colspan=\"2\" align=\"center\"><font size=\"2\"><b>[ ";
    $alphabet = array (translate('All'), "A","B","C","D","E","F","G","H","I","J","K","L","M",
                        "N","O","P","Q","R","S","T","U","V","W","X","Y","Z",translate('Other'));
    $num = count($alphabet) - 1;
    $counter = 0;
    while (list(, $ltr) = each($alphabet)) {
        echo "<a href=\"reviews.$phpEx?op=reviews&letter=$ltr\">$ltr</a>";
        if ( $counter == round($num/2) )
            echo " ]\n<br />\n[ ";
        elseif ( $counter != $num )
            echo "&nbsp;</b>|<b>&nbsp;\n";
        $counter++;
    }
    echo " ]\n\n";
    echo "</td></tr><form action=\"search.$phpEx\" method=\"post\"><tr align=\"center\"><td colspan=\"2\">&gt;&gt;&nbsp;&nbsp;<a class='subtitle1' href=\"reviews.$phpEx?op=write_review\"><b>".translate("Write a Review")."</b></a>&nbsp;&nbsp;&lt;&lt;<br /><br />\n";

    echo "<input type=\"text\" name=\"query\" size=\"17\"><input type=\"hidden\" name=\"type\" value=\"reviews\">\n";


    echo "<input class='button' type=\"submit\" value='" . translate( 'Search' ) . "' /></form>";
    $browser = getenv("HTTP_USER_AGENT"); if (!(ereg("MSIE", "$browser"))) echo "<br /><br />";
    echo "</td></tr>";
}

function display_score($score)
{
    $image = "<img src=\"images/blue.gif\" width=\"16\" height=\"14\" alt=\"\">";
    $halfimage = "<img src=\"images/bluehalf.gif\" width=\"8\" height=\"14\" alt=\"\">";
    $full = "<img src=\"images/star.gif\" width=\"16\" height=\"14\" alt=\"\">";

    if ($score == 10)
    {
        for ($i=0; $i < 5; $i++)
            echo "$full";
    }
    else if ($score % 2)
    {
        $score -= 1;
        $score /= 2;
        for ($i=0; $i < $score; $i++)
            echo "$image";
        echo "$halfimage";
    }
    else
    {
        $score /= 2;
        for ($i=0; $i < $score; $i++)
            echo "$image";
    }
}

function write_review()
{
        global $admin, $sitename, $user, $mpnTables,$phpEx;

        include ("header.$phpEx");
        OpenTable();
        echo "
        <b>".translate("Write a Review for")." $sitename</b><br /><br />
        <i>".translate("Please enter information according to the specifications")."</i><br /><br />
        <form method=\"POST\" action=\"reviews.$phpEx\">
        <b>".translate("Product Title").":</b><br />
        <input type=\"text\" name=\"title\" size=\"50\" maxlength=\"150\"><br />
        <i>".translate("Name of the Reviewed Product.")."</i><br /><br />
        <b>".translate("Review").":</b><br />
        <textarea class=\"textbox\" name=\"text\" rows=\"18\" wrap=\"soft\" cols=\"70\"></textarea><br />
        <i>".translate("Your actual review. Please observe proper grammar! Make it at least 100 words, OK? You may also use HTML tags if you know how to use them.")."</i><br /><br />
        <b>".translate("Your name").":</b><br />";

        $name = $email = null;

        if (_MPN_USER) {
            $cookie = cookiedecode( $user );
            $result=mysql_query("select uname, email from ".$mpnTables['users']." where uname='$cookie[1]' && uid > 1");
            list($name, $email) = mysql_fetch_row($result);
        }
        echo "<input type=\"text\" name=\"reviewer\" size=\"40\" maxlength=\"20\" value=\"$name\"><br />
        <i>".translate("Your Full Name. Required.")."</i><br /><br />
        <b>".translate("Your email").":</b><br />
        <input type=\"text\" name=\"email\" size=\"40\" maxlength=\"30\" value=\"$email\"><br />
        <i>".translate("Your E-mail address. Required.")."</i><br /><br />
        <b>".translate("Score").":</b><br />
        <select name=\"score\">
            <option value=\"10\">10</option>
            <option value=\"9\">9</option>
            <option value=\"8\">8</option>
            <option value=\"7\">7</option>
            <option value=\"6\">6</option>
            <option value=\"5\">5</option>
            <option value=\"4\">4</option>
            <option value=\"3\">3</option>
            <option value=\"2\">2</option>
            <option value=\"1\">1</option>
        </select>
        <i>".translate("Select from 1=poor to 10=excelent.")."</i><br /><br />
        <b>".translate("Related Link").":</b><br />
        <input type=\"text\" name=\"url\" size=\"40\" maxlength=\"100\" value=\"http://\"><br />
        <i>".translate("Product Official Website. Make sure your URL starts by")." \"http://\".</i><br /><br />
        <b>".translate("Link title").":</b><br />
        <input type=\"text\" name=\"url_title\" size=\"40\" maxlength=\"50\"><br />
        <i>".translate("Required if you have a related link, otherwise not required.")."</i><br /><br />";
        if(isset($admin))
        {
                echo "<b>".translate("Image filename").":</b><br />
                <input type=\"text\" name=\"cover\" size=\"40\" maxlength=\"100\"><br />
               <i>".translate("Name of the cover image, located in images/reviews/. Not required.")."</i><br /><br />";
        }
        echo "<i>".translate("Please make sure that the information entered is 100% valid and uses proper grammar and capitalization. For instance, please do not enter your text in ALL CAPS, as it will be rejected.")."</i><br /><br />";

        // Kiril: New Sanitizer

        addFormatOption();

        echo "<input type='hidden' name='clickit_form' value='text' />\n";
        echo "<input type='hidden' name='stripit_form' value='title|cover|reviewer|email|url|url_title|hits' />\n";
        echo "<input type='hidden' name='mpn_sectype' value='1' />\n";

        // End New Saintizer

        echo "<input type=\"hidden\" name=\"op\" value=\"preview_review\"><input class='button' type=\"submit\" value=\"" .translate("Preview!")."\"> <input class='button' type=\"button\" onClick=\"history.go(-1)\" value=" .translate("Cancel!")."></form>";
        CloseTable();
        include ("footer.$phpEx");
}

function preview_review($date, $title, $text, $reviewer, $email, $score, $cover, $url, $url_title, $hits, $id)
{
        global $admin, $locale, $phpEx;


        // Kiril: Start New Sanitizer

        if ( ! $_SERVER['SAN'] -> verifyContent( $url, 1 ) )
        {
            $url = '';
        }

        $prev_text = $text;

        $_SERVER['SAN'] -> adjustFormat( $prev_text, 3, 10 );

        // End New Sanitizer

        include ("header.$phpEx");
        OpenTable();

        $errormsg = NULL;

        echo "<form method=\"post\" action=\"reviews.$phpEx\">";

        if ($title == "")
                $errormsg .= "".translate("Invalid Title... can not be blank")."<br />";

       if ($text == "")
                $errormsg .= "".translate("Invalid review text... can not be blank")."<br />";

        if (($score < 1) || ($score > 10))
                $errormsg .= "".translate("Invalid score... must be between 1 and 10")."<br />";

        if (($hits < 0) && ($id != 0))
                $errormsg .= "".translate("Hits must be a positive integer")."<br />";

        if ($reviewer == "" || $email == "")
                $errormsg .= "".translate("You must enter both your name and your email")."<br />";
        else if ($reviewer != "" && $email != "")
            if (!(eregi("^[0-9a-z]([-_.]?[0-9a-z])*@[0-9a-z]([-.]?[0-9a-z])*\\.[a-z]{2,3}$",$email)))
                        $errormsg .= "".translate("Invalid email (eg: you@hotmail.com)")."<br />";

        if (($url_title != "" && $url =="") || ($url_title == "" && $url != ""))
                $errormsg .= "".translate("You must enter BOTH a link title and a related link or leave both blank")."<br />";
        else if (($url != "") && (!(eregi('(^http[s]*:[/]+)(.*)', $url))))
                $url = "http://" . $url;


        if (isset($errormsg) && $errormsg != "")
                echo "$errormsg<br /><input type=\"button\" onClick=\"history.go(-1)\" value=\"Go back!\">";
        else
        {
            if ($date == "") $date = date("Y-m-d", time());
              $year2 = substr($date,0,4);
              $month = substr($date,5,2);
              $day = substr($date,8,2);
              setlocale(LC_TIME, $locale);

              $fdate = strftime( translate("reviewdate"), mktime(0,0,0,$month,$day,$year2));

            if ($hits == "")
                $hits = 1;

            echo "<table border=\"0\" cellpadding=\"3\" cellspacing=\"3\" width=\"90%\" align=\"center\"><tr><td width=\"100%\">";
            echo "<p><i><b><font size=\"4\">$title</font></b></i></p>\n";
            if ($cover != "")
                echo "<img src=\"images/reviews/$cover\" align=\"right\" border=\"1\" vspace=\"2\">\n";

            echo $prev_text . "\n";

            echo "</td></tr></table><br />\n";

            extrainfo($id, $fdate, $title, $reviewer, $email, $score, $url_title, $url, $hits, 1);


            // NEW PREVIEW ( Copy of Write Review )

            echo "<br /><br /><br />\n";

            echo "<div>\n";

            OpenTable();
            echo "
            <center><b>?? ".translate("Modify Your Review Before Posting")." ??</b></center><br /><br />
            <i>".translate("Please enter information according to the specifications")."</i><br /><br />
            <form method=\"POST\" action=\"reviews.$phpEx\">
            <b>".translate("Product Title").":</b><br />
            <input type=\"text\" name=\"title\" size=\"50\" maxlength=\"150\" value=\"$title\"><br />
            <i>".translate("Name of the Reviewed Product.")."</i><br /><br />
            <b>".translate("Review").":</b><br />
            <textarea class=\"textbox\" name=\"text\" rows=\"18\" wrap=\"soft\" cols=\"70\" value=\"$text\">$text</textarea><br />
            <i>".translate("Your actual review. Please observe proper grammar! Make it at least 100 words, OK? You may also use HTML tags if you know how to use them.")."</i><br /><br />
            <b>".translate("Your name").":</b><br />";

            echo "<input type=\"text\" name=\"reviewer\" size=\"40\" maxlength=\"20\" value=\"$reviewer\"><br />
            <i>".translate("Your Full Name. Required.")."</i><br /><br />
            <b>".translate("Your email").":</b><br />
            <input type=\"text\" name=\"email\" size=\"40\" maxlength=\"30\" value=\"$email\"><br />
            <i>".translate("Your E-mail address. Required.")."</i><br /><br />
            <b>".translate("Score").":</b><br />\n";

            echo "<select name=\"score\">\n";

            for ( $i=1; $i <= 10; $i++ )
            {
                $sel = ( isset( $score ) && $score == $i ) ? ( 'selected' ) : ( '' );

                echo "<option value=\"$i\" $sel>$i</option>\n";
            }

            echo "</select>
            <i>".translate("Select from 1=poor to 10=excelent.")."</i><br /><br />
            <b>".translate("Related Link").":</b><br />
            <input type=\"text\" name=\"url\" size=\"40\" maxlength=\"100\" value=\"$url\"><br />
            <i>".translate("Product Official Website. Make sure your URL starts by")." \"http://\".</i><br /><br />
            <b>".translate("Link title").":</b><br />
            <input type=\"text\" name=\"url_title\" size=\"40\" maxlength=\"50\" value=\"$url_title\"><br />
            <i>".translate("Required if you have a related link, otherwise not required.")."</i><br /><br />";
            if(isset($admin))
            {
                    echo "<b>".translate("Image filename").":</b><br />
                    <input type=\"text\" name=\"cover\" size=\"40\" maxlength=\"100\" value=\"$cover\"><br />
                   <i>".translate("Name of the cover image, located in images/reviews/. Not required.")."</i><br /><br />";
            }
            echo "<i>".translate("Please make sure that the information entered is 100% valid and uses proper grammar and capitalization. For instance, please do not enter your text in ALL CAPS, as it will be rejected.")."</i><br /><br />";

            // Kiril: New Sanitizer

            addFormatOption();

            echo "<input type='hidden' name='clickit_form' value='text' />\n";
            echo "<input type='hidden' name='stripit_form' value='title|cover|reviewer|email|url|url_title|hits' />\n";
            echo "<input type='hidden' name='mpn_sectype' value='1' />\n";

            // End New Saintizer

            echo "<p><b><i>".translate("Does this look right?")." </i></b></p>";

            echo "<input type=\"hidden\" name=\"date\" value=\"$date\">\n";
            echo "<input type=\"hidden\" name=\"hits\" value=\"$hits\">\n";
            echo "<input type='hidden' name='id' value='$id' />\n";

            echo "<input class='button' type=\"submit\" name=\"send_review\" value=\"".translate("Yes")."\">\n";

            echo "<input class='button' type=\"submit\" name=\"preview_review\" value=\"" .translate("Preview!")."\">\n";
            echo " <input class='button' type=\"button\" onClick=\"history.go(-1)\" value=" .translate("Cancel!")."></form>";

            echo "</div>\n";


/*
        // Kiril: New Sanitizer

        echo "<input type='hidden' name='clickit_form' value='text' />\n";
        echo "<input type='hidden' name='stripit_form' value='title|cover|reviewer|email|url|url_title|hits' />\n";
        echo "<input type='hidden' name='mpn_sectype' value='2' />\n";

        // End New Saintizer

        echo "

              <input type=\"hidden\" name=\"op\" value=\"send_review\">
              <input type=\"hidden\" name=\"date\" value=\"$date\">
              <input type=\"hidden\" name=\"title\" value=\"$title\">
              <input type=\"hidden\" name=\"text\" value=\"$text\">
              <input type=\"hidden\" name=\"reviewer\" value=\"$reviewer\">
              <input type=\"hidden\" name=\"email\" value=\"$email\">
              <input type=\"hidden\" name=\"score\" value=\"$score\">
              <input type=\"hidden\" name=\"url\" value=\"$url\">
              <input type=\"hidden\" name=\"url_title\" value=\"$url_title\">
              <input type=\"hidden\" name=\"cover\" value=\"$cover\">
              <input type=\"submit\" value=\"".translate("Yes")."\"> <input type=\"button\" onClick=\"history.go(-1)\" value=\"" .translate("No!")."\"></form>";

        if($id != 0)
                $word = "".translate("modified")."";
        else
                $word = "".translate("added")."";*/

        if(isset($admin))
                echo "<br /><br /><b>".translate("Note:")."</b> ".translate("Currently logged in as admin... this review will be")." ".translate("posted immediately").".";
        }
        CloseTable();

        include ("footer.$phpEx");
}

function send_review($date, $title, $text, $reviewer, $email, $score, $cover, $url, $url_title, $hits, $id)
{
        global $admin, $EditedMessage, $mpnTables,$phpEx;

        // Kiril: Start New Sanitizer

        $sanity_ary = compact( 'title', 'text', 'reviewer', 'email', 'score', 'cover', 'url', 'url_title', 'hits' );
        $_SERVER['SAN'] -> slashIT( $sanity_ary, TRUE );

        extract( $sanity_ary );
        unset( $sanity_ary );

        // End New Sanitizer


        include ("header.$phpEx");


        OpenTable();

        echo "<br /><center>".translate("Thanks for submitting this review")."";
        if ($id != 0)
                echo " ".translate("modification")."";
        else
                echo ", $reviewer";
        echo "!<br />";
        if ((isset($admin)) && ($id == 0))
        {
                @mysql_query("select * from ".$mpnTables['reviews']) or die ("Unable to select records");
                @mysql_query("INSERT INTO ".$mpnTables['reviews']." VALUES (NULL, '$date', '$title', '$text', '$reviewer', '$email', '$score', '$cover', '$url', '$url_title', '1')") or Die("Unable to insert recordset");
                echo "".translate("It is now available in the reviews database.")."";
        }
        else if (($admin) && ($id != 0))
        {

                @mysql_query("UPDATE ".$mpnTables['reviews']." SET date='$date', title='$title', text='$text', reviewer='$reviewer', email='$email', score='$score', cover='$cover', url='$url', url_title='$url_title', hits='$hits' where id = $id") or Die("Unable to update record");
                echo "".translate("It is now available in the reviews database.")."";
        }
        else
        {
                @mysql_query("INSERT INTO ".$mpnTables['reviews_add']." VALUES (NULL, '$date', '$title', '$text', '$reviewer', '$email', '$score', '$url', '$url_title')") or Die("Unable to insert record");
                echo "".translate("The editors will look at your submission. It should be available soon!")."";
        }
        echo "<br /><br />[ <a href=\"reviews.$phpEx\">".translate("Back to Reviews Index")."</a> ]<br /></center>";
        CloseTable();
        include ("footer.$phpEx");
}

function reviews_index()
{
        global $phpEx, $mpnTables;
        include ("header.$phpEx");
        global $bgcolor4, $bgcolor2;
        OpenTable();
        echo "<table border=\"0\" width=\"95%\" cellpadding=\"2\" cellspacing=\"4\" align=\"center\">";

        if (isset($HTTP_GET_VARS['letter']))
        {
            $letter = $HTTP_GET_VARS['letter'];
        }
        else
        {
            $letter = null;
        }

        if (!isset( $reviewer ))
        {
            $reviewer = null;
        }

        reviews_nav($letter, $reviewer);
        echo "<br />";
        $result = mysql_query("select title, description from ".$mpnTables['reviews_main']);
        list($title, $description) = mysql_fetch_row($result);
        echo "<tr><td colspan=\"2\">";
        OpenTable2();
        echo "<center><b>$title</b><br /><br />$description</center>";
        CloseTable();
        echo "<br /></td></tr>";

        echo "<tr><td width=\"50%\" bgcolor=\"$bgcolor2\"><b>".translate("10 most popular reviews")."</td>";
        echo "<td width=\"50%\" bgcolor=\"$bgcolor2\"><b>".translate("10 most recent reviews")."</td></tr>";

        $result_pop = mysql_query("select id, title, hits from ".$mpnTables['reviews']." order by hits DESC limit 10");
        $result_rec = mysql_query("select id, title, date, hits from ".$mpnTables['reviews']." order by date DESC limit 10");
        $y = 1;

        for ($x = 0; $x < 10; $x++)
        {
                $myrow=mysql_fetch_array($result_pop);
                $id = $myrow["id"]; $title = $myrow["title"]; $hits = $myrow["hits"];
                echo "<tr><td width=\"50%\" bgcolor=\"$bgcolor4\">";
                if ($id != "")
                    echo "$y) <a href=reviews.$phpEx?op=showcontent&id=$id>$title</a>";
                else echo "&nbsp;";
                echo "</td>";

                $myrow=mysql_fetch_array($result_rec);

                $id = $myrow["id"]; $title = $myrow["title"]; $hits = $myrow["hits"];
                echo "<td width=\"50%\" bgcolor=\"$bgcolor4\">";
                if ($id != "")
                    echo "$y) <a href=reviews.$phpEx?op=showcontent&id=$id>$title</a>";
                else echo "&nbsp;";
                echo "</td></tr>";
                $y++;

        }
        echo "<tr><td colspan=\"2\"><br /></td></tr>";

        $result = mysql_query("SELECT * FROM ".$mpnTables['reviews']);
        $numresults = mysql_numrows($result);
        echo "<tr><td colspan = 2><br /><center>".translate("There are")." $numresults ".translate("reviews in the database")."</center></td></tr></table>";

        // memory flush
        mysql_free_result($result_pop);
        mysql_free_result($result_rec);
        mysql_free_result($result);

        CloseTable();
        echo "<br />";
        OpenTable();
        echo "<center>Reviews add-on from Jeff Lambert, <a href=\"mailto:jeffx@qchc.com\">jeffx@qchc.com</a><br />\n";
        echo "For the latest version of this script and for more scripts, go to <a href=\"http://www.qchc.com\">www.qchc.com</a><br /></center>\n";
        CloseTable();
        include ("footer.$phpEx");
}

function reviews($letter, $field, $order) {
        global $bgcolor4, $sitename, $mpnTables,$phpEx;
        include ("header.$phpEx");
        if (!isset($field)) { $field = "title"; }
        if (!isset($letter)) { $letter = ""; }
        if (!isset($name)) { $name = ""; }
        if (!isset($order)) { $order = "ASC"; }
        if (( $letter != translate('Other') ) AND ( $letter != translate('All') ))
            $where = "where upper(title) like upper('".$letter."%') ";
        elseif (( $letter == translate('Other') ) AND ( $letter != translate('All') ))
            $where = "where title REGEXP \"^\[1-9]\" ";
        elseif ($name != "")
            $where = "where UPPER(reviewer) LIKE UPPER('%".$name."%') ";
        else
            $where = "";
        $result = mysql_query("SELECT id, title, hits, reviewer, score FROM ".$mpnTables['reviews']." $where ORDER by $field $order");
        OpenTable();
        echo "<table border=\"0\" width=\"95%\" cellpadding=\"2\" cellspacing=\"4\" align=\"center\">";
        reviews_nav($letter, $name);
        echo "</table>";

        $numresults = mysql_numrows($result);

        if ($numresults == 0)
        {
                echo "<i><b>".translate("There isn't any Review for letter")." \"$letter\"</b></i><br /><br />";
        }
        elseif ($numresults > 0)
        {

        echo "<table border=\"0\" width=\"100%\" cellpadding=\"2\" cellspacing=\"4\">
                        <tr>
                                <td width=\"40%\" bgcolor=\"$bgcolor4\">
                                        <p align=\"left\"><a href=\"reviews.$phpEx?op=reviews&letter=$letter&field=title&order=ASC\"><img src=\"images/download/up.gif\" border=\"0\" width=\"15\" height=\"9\" Alt=\"" .translate("Sort Ascending")."\"></a><B> " .translate("Product Title")." </B><a href=\"reviews.$phpEx?op=reviews&letter=$letter&field=title&order=DESC\"><img src=\"images/download/down.gif\" border=\"0\" width=\"15\" height=\"9\" Alt=\"".translate("Sort Descending")."\"></a>
                                </td>
                                <td width=\"21%\" bgcolor=\"$bgcolor4\">
                                        <p align=\"center\"><a href=\"reviews.$phpEx?op=reviews&letter=$letter&field=reviewer&order=ASC\"><img src=\"images/download/up.gif\" border=\"0\" width=\"15\" height=\"9\" Alt=\"" .translate("Sort Ascending")."\"></a><B> " .translate("Reviewer")." </B><a href=\"reviews.$phpEx?op=reviews&letter=$letter&field=reviewer&order=desc\"><img src=\"images/download/down.gif\" border=\"0\" width=\"15\" height=\"9\" Alt=\"".translate("Sort Descending")."\"></a>
                                </td>
                                <td width=\"21%\" bgcolor=\"$bgcolor4\">
                                        <p align=\"center\"><a href=\"reviews.$phpEx?op=reviews&letter=$letter&field=score&order=ASC\"><img src=\"images/download/up.gif\" border=\"0\" width=\"15\" height=\"9\" Alt=\"" .translate("Sort Ascending")."\"></a><B> " .translate("Score")." </B><a href=\"reviews.$phpEx?op=reviews&letter=$letter&field=score&order=DESC\"><img src=\"images/download/down.gif\" border=\"0\" width=\"15\" height=\"9\" Alt=\"".translate("Sort Descending")."\"></a>
                                </td>
                                <td width=\"18%\" bgcolor=\"$bgcolor4\">
                                        <p align=\"center\"><a href=\"reviews.$phpEx?op=reviews&letter=$letter&field=hits&order=ASC\"><img src=\"images/download/up.gif\" border=\"0\" width=\"15\" height=\"9\" Alt=\"" .translate("Sort Ascending")."\"></a><B> " .translate("Hits")." </B><a href=\"reviews.$phpEx?op=reviews&letter=$letter&field=hits&order=DESC\"><img src=\"images/download/down.gif\" border=\"0\" width=\"15\" height=\"9\" Alt=\"".translate("Sort Descending")."\"></a>
                                </td>
                        </tr>";

                while($myrow=mysql_fetch_array($result))
                        {
                                $title = $myrow["title"];
                                $id = $myrow["id"];
                                $reviewer = $myrow["reviewer"];
//                                $email = $myrow["email"];
                                $score = $myrow["score"];
                                $hits = $myrow["hits"];
                                echo "<tr>
                                <td width=\"40%\" bgcolor=\"#EEEEEE\"><a href=\"reviews.$phpEx?op=showcontent&id=$id\">$title</a></td>
                                <td width=\"21%\" bgcolor=\"#EEEEEE\">";
                                if ($reviewer != "")
                                        echo "<center>$reviewer</center>";
                                echo "</td><td width=\"21%\" bgcolor=\"#EEEEEE\"><center>";
                                display_score($score);
                                echo "</center></td><td width=\"18%\" bgcolor=\"#EEEEEE\"><center>$hits</center></td></tr>";
                        }
                echo "</table>";
                echo "<br /><center>$numresults ".translate("Total Review(s) found.")."</center><br /><br />";
        }
        echo "<center>[ <a href=\"reviews.$phpEx\">".translate("Return to Main Menu")."</a> ]</center>";

        // memory flush
        mysql_free_result($result);
        CloseTable();
        include ("footer.$phpEx");
}

function postcomment( $id ) {
    global $user, $cookie, $AllowableHTML, $anonpost,$phpEx;
    include("header.$phpEx");

    //$title = urldecode($title);

    $result = mysql_query("SELECT title FROM ".$mpnTables['reviews']." where id='$id'");
    list( $title ) = mysql_fetch_row( $result );
    mysql_free_result( $result );


    OpenTable();

    echo "<center><font size=3><b>".translate("Comment on the Review:")." $title</b><br /><br /></font></center><form action=\"reviews.$phpEx\" method=\"post\">";
    if (((!$user) and ($anonpost==1)) or (isset($user))) {
        if (!$user) {
            echo "<b>".translate("Your Nickname:")."</b> Anonymous [ <a href=user.$phpEx>".translate("Create</a> an account")." ]<br /><br />";
            $cookie[1] = "Anonymous";
        } else {
            echo "<b>".translate("Your Nickname:")."</b> $cookie[1]<br />";
            if ($anonpost==1) {
                echo "<input type=checkbox name=\"xanon\" value=\"1\"> ".translate("Post Anonymously")."</input><br /><br />";
            }
        }
        echo "
        <input type=\"hidden\" name=\"uname\" value=\"$cookie[1]\">
        <input type=\"hidden\" name=\"id\" value=\"$id\">
        <b>".translate("This Product Score:")."</b>
        <select name=\"score\">\n
            <option value=\"10\">10</option>\n
            <option value=\"9\">9</option>\n
            <option value=\"8\">8</option>\n
            <option value=\"7\">7</option>\n
            <option value=\"6\">6</option>\n
            <option value=\"5\">5</option>\n
            <option value=\"4\">4</option>\n
            <option value=\"3\">3</option>\n
            <option value=\"2\">2</option>\n
            <option value=\"1\">1</option>\n
        </select><br /><br />\n
        <b>".translate("Your Comment:")."</b><br />

        <textarea name=\"comments\" rows=\"15\" cols=\"70\" wrap=\"soft\"></textarea><br />\n

        ".translate("Allowed HTML:")."<br />";


        while (list($key,)= each($AllowableHTML)) echo " &lt;".$key."&gt;";

        // Kiril: New Sanitizer

        addFormatOption();

        echo "<input type='hidden' name='clickit_form' value='comments' />\n";
        echo "<input type='hidden' name='mpn_sectype' value='2' />\n";

        // End New Sanitizer


        echo "<br /><br /><input type=\"hidden\" name=\"op\" value=\"savecomment\"><input class='button' type=\"submit\" value=\"" .translate("Submit")."\"></form>";
    } else {
         echo translate("No Comments Allowed for Anonymous, please <a href='user.php'>register</a>");
    }
    CloseTable();
    include("footer.$phpEx");
}

function savecomment($xanon, $uname, $id, $score, $comments) {
    global $mpnTables,$phpEx;
    if ($xanon) {
        $uname = "Anonymous";
    }

    mysql_query("insert into ".$mpnTables['reviews_comments']." values (NULL, '$id', '$uname', now(), '$comments', '$score')");

    $_SERVER['F_LIB'] -> redirectRequest( 'reviews.php?op=showcontent&id=' . $id );

}

function r_comments( $id )
{
    global $admin, $mpnTables,$phpEx;

    $result = mysql_query("SELECT title FROM ".$mpnTables['reviews']." where id='$id'");
    list( $title ) = mysql_fetch_row( $result );
    mysql_free_result( $result );

    $result = mysql_query("select cid, userid, date, comments, score from ".$mpnTables['reviews_comments']." where rid='$id' ORDER BY cid DESC");


    while(list($cid, $uname, $date, $comments, $score) = mysql_fetch_row($result)) {
        OpenTable();

       // $title = urldecode($title);

        echo "<b>$title</b><br />";

        if ($uname == "Anonymous") {
            echo "".translate("Posted by")." $uname ".translate("on")." ".strftime(translate("datestring5"),strtotime($date))."<br />";
        } else {
            echo "".translate("Posted by")." <a href=user.$phpEx?op=userinfo&uname=$uname>$uname</a> ".translate("on")." ".strftime(translate("datestring5"),strtotime($date))."<br />";
        }
        echo "".translate("My Score:")." ";
        display_score($score);
        if ($admin) {
           echo "<br /><b>".translate("Admin:")."</b> [ <a href=reviews.$phpEx?op=del_comment&cid=$cid&id=$id>".translate("Delete")."</a> ]</font><hr noshade size=1><br /><br />";
        } else {
            echo "</font><hr noshade size=1><br /><br />";
        }

        // Kiril: Start New Sanitizer

        $_SERVER['SAN'] -> slashIT( $comments );
        $_SERVER['SAN'] -> adjustFormat( $comments, 3, 10 );

        // End New Sanitizer

        echo "<div id='reviewcomm'>\n";

            echo $comments . "\n";

        echo "</div>\n";

        CloseTable();
        echo "<br />";
    }
}

function showcontent($id)
{
        global $admin, $uimages, $mpnTables, $locale, $phpEx;
        include ("header.$phpEx");

        OpenTable();
        mysql_query("UPDATE ".$mpnTables['reviews']." SET hits=hits+1 WHERE id=$id");
        $result = mysql_query("SELECT * FROM ".$mpnTables['reviews']." WHERE id=$id");

        echo "<table border=\"0\" cellpadding=\"3\" cellspacing=\"3\" width=\"95%\" align=\"center\"><tr><td width=\"100%\">";

        $myrow =  mysql_fetch_array($result);
        $id =  $myrow["id"];
        $date = $myrow["date"];
        $year = substr($date,0,4);
        $month = substr($date,5,2);
        $day = substr($date,8,2);
        setlocale(LC_TIME, $locale);
        $formatstring = translate("reviewdate");
        $fdate = strftime($formatstring, mktime(0,0,0,$month,$day,$year));
        $title = $myrow["title"];
        $text = $myrow["text"];
        $cover = $myrow["cover"];
        $reviewer = $myrow["reviewer"];
        $email = $myrow["email"];
        $hits = $myrow["hits"];
        $url = $myrow["url"];
        $url_title = $myrow["url_title"];
        $score = $myrow["score"];

        echo "<p><i><b><font size=\"4\">$title</b></i></font><br />";
         echo "<div id='reviewmain'><p>";
        if ($cover != "")
        {
            echo "<img src=\"images/reviews/$cover\" align=\"right\" border=\"1\" vspace=\"2\">";
        }

        // Kiril: Start New Sanitizer

        $sanity_ary    = compact( 'title', 'text', 'cover', 'reviewer', 'email', 'url', 'url_title' );
        $_SERVER['SAN'] -> slashIT( $sanity_ary );

        extract( $sanity_ary );
        unset( $sanity_ary );

        $_SERVER['SAN'] -> adjustFormat( $text, 3, 10 );

        // End New Sanitizer

        echo $text . "\n";

        echo "</p></div>\n";

        echo "</td></tr></table>";

        extrainfo($id, $fdate, $title, $reviewer, $email, $score, $url_title, $url, $hits, 0);

        // memory flush
        mysql_free_result($result);

        //$title = urlencode($title);

        echo "<br /><br /><center><b>[ <a href=\"reviews.$phpEx\">".translate("Back to Reviews Index")."</a> ]</b></center>";
        CloseTable();
        echo "<br />";
        r_comments($id, $title);
        include ("footer.$phpEx");
}

function mod_review($id) {
    global $admin, $mpnTables,$phpEx;
    include_once("header.$phpEx");
    OpenTable();
    if (($id == 0) || (!($admin)))
        echo translate("This function must be passed argument id, or you are not admin.");
    else if (($id != 0) && ($admin))
    {
        $result = mysql_query("select * from ".$mpnTables['reviews']." where id = $id");

        while($myrow =  mysql_fetch_array($result))
        {
                $id =  $myrow["id"];
                $date = $myrow["date"];
                $title = $myrow["title"];
                $text = $myrow["text"];
                $cover = $myrow["cover"];
                $reviewer = $myrow["reviewer"];
                $email = $myrow["email"];
                $hits = $myrow["hits"];
                $url = $myrow["url"];
                $url_title = $myrow["url_title"];
                $score = $myrow["score"];
        }

        // Kiril: Start New Sanitizer

        $sanity_ary = compact( 'title', 'text', 'cover', 'reviewer', 'email', 'url', 'url_title' );
        $_SERVER['SAN'] -> slashIT( $sanity_ary );

        extract( $sanity_ary );
        unset( $sanity_ary );

        // End New Sanitizer


        echo "<center><b>".translate("Review Modification")."</b></center><br /><br />";
        echo "<form method=\"POST\" action=\"reviews.$phpEx?op=preview_review\"><input type=\"hidden\" name=\"id\" value=\"$id\">";
        echo "<table border=0 width=\"100%\">
                <tr>
                        <td width=\"12%\"><b>".translate("Date:")."</b></td>
                        <td><input type=\"text\" name=\"date\" size=\"15\" VALUE=\"$date\" maxlength=10></td>
                </tr>
                <tr>
                        <td width=\"12%\"><b>".translate("Title:")."</b></td>
                        <td><input type=\"text\" name=\"title\" size=\"50\" maxlength=\"150\" value=\"$title\"></td>
                </tr>
                <tr>
                        <td width=\"12%\"><b>".translate("Text:")."</b></td>
                        <td><textarea class=\"textbox\" name=\"text\" rows=\"18\" wrap=\"soft\" cols=\"70\">$text</textarea></td>
                </tr>
                <tr>
                        <td width=\"12%\"><b>".translate("Reviewer:")."</b></td>
                        <td><input type=\"text\" name=\"reviewer\" size=\"30\" maxlength=\"20\" value=\"$reviewer\"></td>
                </tr>
                <tr>
                        <td width=\"12%\"><b>".translate("Email:")."</b></td>
                        <td><input type=\"text\" name=\"email\" value=\"$email\" size=\"30\" maxlength=\"20\"></td>
                </tr>
                <tr>
                        <td width=\"12%\"><b>".translate("Score:")."</b></td>
                        <td><select name=\"score\">\n
                                        <option selected value=\"$score\">$score</option>\n
                                        <option value=\"10\">10</option>\n
                                        <option value=\"9\">9</option>\n
                                        <option value=\"8\">8</option>\n
                                        <option value=\"7\">7</option>\n
                                        <option value=\"6\">6</option>\n
                                        <option value=\"5\">5</option>\n
                                        <option value=\"4\">4</option>\n
                                        <option value=\"3\">3</option>\n
                                        <option value=\"2\">2</option>\n
                                        <option value=\"1\">1</option>\n
                                        </select></td>
                </tr>
                <tr>
                        <td width=\"12%\"><b>".translate("Link:")."</b></td>
                        <td><input type=\"text\" name=\"url\" value=\"$url\" size=\"30\" maxlength=\"100\"></td>
                </tr>
                <tr>
                        <td width=\"12%\"><b>".translate("Link title:")."</b></td>
                        <td><input type=\"text\" name=\"url_title\" value=\"$url_title\" size=\"30\" maxlength=\"50\"></td>
                </tr>
                <tr>
                        <td width=\"12%\"><b>".translate("Cover image:")."</b></td>
                        <td><input type=\"text\" name=\"cover\" value=\"$cover\" size=\"30\" maxlength=\"100\"></td>
                </tr>
                <tr>
                        <td width=\"12%\"><b>".translate("Hits:")."</b></td>
                        <td><input type=\"text\" name=\"hits\" value=\"$hits\" size=\"5\" maxlength=\"5\"></td>
                </tr>
        </table>";

        // Kiril: New Sanitizer

        addFormatOption();

        echo "<input type='hidden' name='clickit_form' value='text' />\n";
        echo "<input type='hidden' name='stripit_form' value='title|cover|reviewer|email|url|url_title|hits' />\n";
        echo "<input type='hidden' name='mpn_sectype' value='1' />\n";

        // End New Saintizer

        echo "<input type=\"hidden\" name=\"op\" value=\"preview_review\"><input class='button' type=\"submit\" value=\"".translate("Preview Modifications")."\">&nbsp;&nbsp;<input class='button' type=\"button\" onClick=\"history.go(-1)\" value=".translate("Cancel")."></form>";
        // memory flush
        mysql_free_result($result);
    }
    CloseTable();
    include ("footer.$phpEx");
}

function del_review($id_del, $yes) {
 global $admin, $mpnTables,$phpEx;
 if (!isset($yes)) { $yes = 0; }
 if ($admin) {
  if ($yes) {
   mysql_query("delete from ".$mpnTables['reviews_comments']." where rid = '$id_del'");
   mysql_query("delete from ".$mpnTables['reviews']." where id = '$id_del'");

   $_SERVER['F_LIB'] -> redirectRequest( 'reviews.php' );

  } else {
   include("header.$phpEx");
   OpenTable();
   echo "<h3>".sprintf(translate("Delete Review %s"),$id_del)."</h3>";
   echo "".sprintf(translate("Are you sure you want to delete review %s?"),$id_del)." ";
   echo "[ <a href=\"reviews.$phpEx?op=del_review&id_del=$id_del&yes=1\">" .translate("Yes")."</a> | <a href=\"reviews.$phpEx?op=showcontent&id=$id_del\">" .translate("No")."</a> ]<br />";
   CloseTable();
   include("footer.$phpEx");
  }
 } else
  echo "ACCESS DENIED";
}

function del_comment($cid, $id) {
        global $admin, $mpnTables,$phpEx;
        if ($admin) {
            mysql_query("delete from ".$mpnTables['reviews_comments']." where cid='$cid'");

            $_SERVER['F_LIB'] -> redirectRequest( 'reviews.php?op=showcontent&id=' . $id );

        } else {
            echo "ACCESS DENIED";
        }
}

function PrintReview($id)
{
    global $site_logo, $sitename, $site_font, $mpnTables,$phpEx;

    if(!isset($id)) {  $_SERVER['F_LIB'] -> redirectRequest( 'reviews.php' ); }

    $result = mysql_query("SELECT date, title, text, reviewer, email, score, cover, url, url_title FROM ".$mpnTables['reviews']." WHERE id=$id");
    list($date, $title, $text, $reviewer, $email, $score, $cover, $url, $url_title) = mysql_fetch_row($result);

    // Kiril: Start New Sanitizer

    $sanity_ary = compact( 'date', 'title', 'text', 'reviewer', 'email', 'score', 'cover', 'url', 'url_title' );
    $_SERVER['SAN'] -> slashIT( $sanity_ary );
    extract( $sanity_ary );
    unset( $sanity_ary );
    $_SERVER['SAN'] -> adjustFormat( $text, 3, 10 );

    // End New Sanitizer

    // Start Output

    echo $_SERVER['F_LIB'] -> generateSAHeader( 'mpnprint', 'mpn_print.css', 'screen,print', $title );

    echo "<body>\n";

    echo "<h1>$title</h1>\n";
    echo "<h2>" . translate( 'A' ) . " $sitename " . translate( 'Review' ) . "</h2>\n";
    echo "<h3>" . _MPN_ROOT_URI . "</h3>\n";
    echo "<br /><br />\n";

    /*if ($cover != "")
    {
        echo "<img src=\"images/reviews/$cover\" align=\"right\" border=\"1\" vspace=\"2\">\n";
    }*/

    echo "<p class='info'>\n";

        echo "<b>" .translate( "Reviewer:" )."</b> $reviewer\n";

        if ( $email != '' )
        {
             echo "( $email )\n";
        }

        echo "<br />\n";

        echo "<b>" .translate( "Added:" )."</b> " . strftime( translate( 'datestring4' ), strtotime( $date ) ) . "<br />\n";

        echo "<b>" .translate("Score:")." $score</b>\n";

        if ( $url_title != '' )
        {
            echo "<br /><b>" .translate("Related Link:")." </b> $url_title<br />\n";
        }

        if ( $url != '' )
        {
            echo "<b>" .translate("Related URL:")."</b> $url<br />\n";
        }

    echo "</p>\n";

    echo "<hr /><br />\n";

    echo "<div class='content'>\n";

        echo $text;

    echo "</div>\n";

    echo "<br /><hr /><br />\n";

    echo "<div class='footer'>\n";

        echo "" .translate("This review comes from")." $sitename<br />
        <a href=\"" . _MPN_ROOT_URI . "\">" . _MPN_ROOT_URI . "</a><br /><br />
        " .translate("The URL for this review is:")."<br />
        <a href=\"" . _MPN_ROOT_URI . "reviews.$phpEx?op=showcontent&id=$id\">" . _MPN_ROOT_URI . "reviews.$phpEx?op=showcontent&id=$id</a>\n";

    echo "</div>\n";

    echo "</body></html>\n";
}

function extrainfo($id, $fdate, $title, $reviewer, $email, $score, $url_title, $url, $hits, $preview) {

    global $admin,$anonpost,$user, $mpnTables,$phpEx;
    echo "<br /><br /><table bgcolor=\"#000000\" cellspacing=\"0\" cellpadding=\"0\" align=\"center\"><tr><td align=\"center\" valign=\"middle\"><table border=\"0\" width=\"500\" bgcolor=\"#000000\" cellpadding=\"3\" cellspacing=\"2\" align=\"center\">";
    echo "<tr><td COLSPAN=\"2\" bgcolor=\"#101070\"><font COLOR=\"#FFFFFF\"><img src=\"images/download/info.gif\" width=\"16\" height=\"16\" alt=\"\">  <b>" .translate("Extra Information....")."</b></font></td></tr>";
    echo "<tr><td width=\"125\" bgcolor=\"silver\">" .translate("Date Added:")."</td><td bgcolor=\"#FFFFFF\" width=\"375\">$fdate</td></tr>";
    $result = mysql_query("SELECT uname FROM ".$mpnTables['users']." where uname='$reviewer' && uid > 1");
    if (!$result) {
        $name = "";
    } else {
        list($name) = mysql_fetch_row($result);
    }
    if ($name != "") {
        echo "<tr><td width=\"125\" bgcolor=\"silver\">" .translate("Reviewer:")."</td><td bgcolor=\"WHITE\" width=\"375\">
        <a href=\"user.$phpEx?op=userinfo&uname=$name\" target=\"blank\">$reviewer</a>
        (<a href=\"mailto:$email\">$email</a>)</td></tr>";
    } else {
        echo "<tr><td width=\"125\" bgcolor=\"silver\">" .translate("Reviewer:")."</td><td bgcolor=\"WHITE\" width=\"375\">$reviewer (<a href=\"mailto:$email\">$email</a>)</td></tr>";
    }
    if ($score != "")
    {
        echo "<tr><td width=\"125\" bgcolor=\"silver\">" .translate("Score:")."</td><td bgcolor=\"WHITE\" width=\"375\">";
        display_score($score);
        $help = sprintf(translate("read %s times"),$hits);
        echo "  ($help)</td></tr>";
    }
    if ($url != "")
        echo "<tr><td width=\"125\" bgcolor=\"silver\">" .translate("Related Link:")."</td><td bgcolor=\"WHITE\" width=\"375\"><a href=\"$url\" target=\"new\">$url_title</a>";
    if (!$preview)
    {
        echo "<tr><td width=\"125\" bgcolor=\"silver\">" .translate("Options:")."</td><td bgcolor=\"WHITE\" width=\"375\">
        ( ";
        if ((isset($user)) or ($anonpost==1)) {
            echo "<a href=\"reviews.$phpEx?op=postcomment&id=$id\"><img src=\"images/forum/icons/edit.gif\" width=\"20\" height=\"16\" border=\"0\" alt=\"\"> " .translate("Comment")."</a> |&nbsp;";
        }
        echo "<a href=\"reviews.$phpEx?op=PrintReview&id=$id\"><img src=\"images/print.gif\" border=\"0\" Alt=\"\" width=\"15\" height=\"11\"> " .translate("Print")."</a> |&nbsp;
        <a href=\"reviews.$phpEx?op=SendReview&id=$id\"><img src=\"images/forum/icons/email.gif\" border=\"0\" Alt=\"\" width=\"16\" height=\"14\"> " .translate("Send")."</a> )</td></tr>";
        if ($admin) {
            echo "<tr><td bgcolor=\"white\" colspan=\"2\"><b>Admin (ID $id): [ <a href=\"reviews.$phpEx?op=mod_review&id=$id\">" .translate("Modify")."</a> ] - [ <a href=\"reviews.$phpEx?op=del_review&id_del=$id\">" .translate("Delete")."</a> ]</td></tr>";
        }
        if ((!$user) and ($anonpost==0)) {
            echo "<tr><td bgcolor=\"white\" colspan=\"2\">".translate("No Comments Allowed for Anonymous, please <a href='user.php'>register</a>")."</td></tr>";
        }
    }
    echo "</table></td></tr></table>";
}

function SendReview($id) {
    global $user, $mpnTables,$phpEx;
    if(!isset($id)) { exit(); }
    include ("header.$phpEx"); ?>
    <SCRIPT LANGUAGE="JavaScript">
    // Function for Validating Forms
    function CheckForm(form)
    {
        if ( form.yname.value == "" ){
                alert( "<?php echo translate("Please enter your Name."); ?>" )
                form.yname.focus()
                return false
        }
        else if (form.ymail.value == ""){
                alert( "<?php echo translate("Please enter your e-mail address."); ?>" )
                form.ymail.focus()
                return false
        }
        else if ( form.fname.value == "" ){
                alert( "<?php echo translate("Please enter your friend's name."); ?>" )
                form.fname.focus()
                return false
        }
        else if ( form.fmail.value == "" ){
                alert( "<?PHP echo translate("Please enter your friend's email."); ?>" )
                form.fmail.focus()
                return false
        }
        else {
            document.friend.submit()
            return true
        }
    }
    //--->

    </script>
    <?PHP
    $result=mysql_query("select title from ".$mpnTables['reviews']." where id=$id");
    list($title) = mysql_fetch_row($result);
    OpenTable();
    echo "<font size=\"4\"><b>" .translate("Send Review to a Friend")."</b></font><br /><br />
    ". sprintf(translate("You will send the review <b>%s</b> to a specified friend:"),$title)."<br /><br />
    <form action=\"reviews.$phpEx\" method=\"post\" name=\"friend\">
    <input type=\"hidden\" name=\"id\" value=\"$id\">";

    $yn = $ye = null;

    if (_MPN_USER) {
        $cookie = cookiedecode( $user );
        $result=mysql_query("select uname, email from ".$mpnTables['users']." where uname='$cookie[1]' && uid > 1");
        list($yn, $ye) = mysql_fetch_row($result);
    }
    echo "
        <TABLE BORDER=0>
    <TR>
      <TD ALIGN=\"RIGHT\">".translate("Your Name: ")."</TD>
      <TD><input class=textbox type=text name=\"yname\" value=\"$yn\" SIZE=35></TD>
    </TR>
    <TR>
      <TD ALIGN=\"RIGHT\">".translate("Your Email: ")."</TD>
      <TD><input class=textbox type=text name=\"ymail\" value=\"$ye\" SIZE=35></TD>
    </TR>
    <TR>
      <TD ALIGN=\"RIGHT\">".translate("Friend Name: ")."</TD>
      <TD><input class=textbox type=text name=\"fname\" SIZE=35></TD>
    </TR>
    <TR>
      <TD ALIGN=\"RIGHT\">".translate("Friend Email: ")."</TD>
      <TD><input class=textbox type=text name=\"fmail\" SIZE=35></TD>
    </TR>
    </TABLE>";
    echo "<input type=\"hidden\" name=\"op\" value=\"EmailReview\">
    <input type=\"button\" value=\"" .translate("Send")."\" onClick=\"CheckForm(this.form)\"></form>";
   CloseTable();
    include ("footer.$phpEx");
}

function EmailReview($id, $yname, $ymail, $fname, $fmail) {
    global $sitename, $mpnTables,$phpEx, $mail;
    $result = mysql_query("SELECT date, title, text, reviewer, email, score, cover, url, url_title FROM ".$mpnTables['reviews']." WHERE id=$id");
    list($date, $title, $text, $reviewer, $email, $score, $cover, $url, $url_title) = mysql_fetch_row($result);
    $subject = "Interesting Review on $sitename";
    $message  = translate('Hello ') . $fname . ",\n";
    $message .= translate('Your Friend ') . $yname . translate(' considered the following review interesting and wanted to send it to you.') . "\n\n";
    $message .= '-- ' . stripslashes($title) . "\n<pre>" . stripslashes($text) . "</pre>\n\n";
    $message .= translate('Reviewer : ') . $reviewer . "\n";
    $message .= translate('Score : ') . $score . "\n\n";
    $message .= translate('You can read more interesting reviews at ') . $sitename . "\n";
    $message .= '<a href = "' . _MPN_ROOT_URI . '">' . _MPN_ROOT_URI . '</a>';
    $mail->From = $ymail;
    $mail->FromName = $yname;
    $mail->AddAddress($fmail);
    $mail->AddReplyTo($ymail);
    $mail->Subject = stripslashes($subject);
    $mail->Body = nl2br( stripslashes($message) );
    $mail->AltBody = strip_tags( stripslashes($message) );
    $mail->Send();

    include ("header.$phpEx");
    OpenTable();
    echo "<h3>" .translate("Review Sent")."</h3><blockquote>".sprintf(translate("Thanks for supporting the %s website, %s."),$sitename,$yname)."
    <br />".sprintf(translate("The Review has been sent to %s at %s."),$fname,$fmail)."</blockquote>";
    echo "<p align=\"center\"><b>[ <a href=\"reviews.$phpEx\">" .translate("Return to main")."</a> ]</b></p>";
    CloseTable();
    include ("footer.$phpEx");
}

if ( !isset( $op ) )
{
    if ( isset( $_POST['send_review'] ) && $_POST['send_review'] == translate( 'Yes' ) )
    {
        $op = 'send_review';
    }
    else if ( isset( $_POST['preview_review'] ) && $_POST['preview_review'] = translate( 'Preview!' ) )
    {
        $op = 'preview_review';
    }
    else
    {
        $op = null;
    }
}

switch($op) {

    case "reviews":
    if (!isset($field))
    {
        $field = null;
    }

    if (!isset($order))
    {
        $order = null;
    }

    reviews($letter, $field, $order);
    break;

    case "showcontent":
    showcontent($id);
    break;

    case "write_review":
    write_review();
    break;

    case "preview_review":
    if (!isset($date))
    {
        $date = null;
    }

    if (!isset($hits))
    {
        $hits = null;
    }

    if (!isset($id))
    {
        $id = null;
    }

    preview_review($date, $title, $text, $reviewer, $email, $score, $cover, $url, $url_title, $hits, $id);
    break;

    case "send_review":
    send_review($date, $title, $text, $reviewer, $email, $score, $cover, $url, $url_title, $hits, $id);
    break;

    case "del_review":
    if ( !isset( $yes ) ) { $yes = 0; }
    del_review( $id_del, $yes );
    break;

    case "mod_review":
    mod_review($id);
    break;

    case "postcomment":
    postcomment($id);
    break;

    case "savecomment":
    savecomment($xanon, $uname, $id, $score, $comments);
    break;

    case "del_comment":
    del_comment($cid, $id);
    break;

    case "PrintReview":
    PrintReview($id);
    break;

    case "SendReview":
    SendReview($id);
    break;

    case "EmailReview":
    EmailReview($id, $yname, $ymail, $fname, $fmail);
    break;

    default:
    reviews_index();
    break;
}

?>
