<?

	if (($UploadedFile != "none") AND ($UserInfo["Add File"]))
	{
		/* 
		** if we have necessary fields, add file
		*/
		
		// strip HTML tags from user input to guard against hacking
		
		$inputName = strip_tags($inputName);
		$inputDescription = strip_tags($inputDescription);
		$inputKeywords = strip_tags($inputKeywords);
		$inputResource = strip_tags($inputResource);
	
		// escape single quotes before forming query
		
		$inputName = addslashes($inputName);
		$inputDescription = addslashes($inputDescription);
		$inputKeywords = addslashes($inputKeywords);
		$inputResource = addslashes($inputResource);
		
			
		$Query = "INSERT INTO node ";
		$Query .= "(Parent, Creator, Name, Description, Keywords, Content, Icon, Resource, Created, LinkCount, DisplayOrder, LastChecked) "; 
		$Query .= "VALUES ( ";
		$Query .= "$pathway, ";
		if ($UserInfo["ID"])
		{
			$Query .= $UserInfo["ID"] . ", ";
		}
		else
		{
			$Query .= "0, ";
		}
		$Query .= "'" . $inputName . "', ";
		$Query .= "'" . $inputDescription . "', ";
		$Query .= "'" . $inputKeywords . "', ";
		$Query .= "$inputContent, ";
		$Query .= "'" . $inputIcon. "', ";
		$Query .= "'" . $inputResource . "', ";
		$Query .= "now(), ";
		$Query .= "0, ";
		$Query .= "$inputDisplayOrder, ";
		$Query .= "'1970-02-18')"; //check new links right away
		
		$DatabaseResult = mysql_query($Query, $DatabaseLink);
		if(!$DatabaseResult)
		{
			$ActionResults .= "Add failed: " . mysql_error();
		}
		else
		{
			$newnode = mysql_insert_id($DatabaseLink);
			
			$Query = "INSERT INTO file ";
			$Query .= "(ID, FileName, Size, Type, Instructions) ";
			$Query .= "VALUES ( ";
			$Query .= "$newnode, ";
			$Query .= "'" . addslashes($UploadedFile_name) . "', ";
			$Query .= "$UploadedFile_size, ";
			$Query .= "'" . addslashes($UploadedFile_type) . "', ";
			$Query .= "'" . addslashes($inputInstructions) . "'";
			$Query .= ")";
			
			$DatabaseResult = mysql_query($Query, $DatabaseLink);
			if(!$DatabaseResult)
			{
				$ActionResults .= "Add failed: " . mysql_error();
			}
			else
			{
				// move uploaded file to appropriate directory
		
				copy($UploadedFile, FILE_PATH . $newnode . "_" . $UploadedFile_name);
				unlink($UploadedFile);
				
				$ActionResults .= "Node Added!";
			}
		}
		
		
		/* 
		** send mail to the list 
		*/
		if($inputSendMail == "")
		{
			$ActionResults .= "<BR>\n";
			$ActionResults .= "Mail: ";			
		
			$Query = "SELECT Private ";
			$Query .= "FROM pathway ";
			$Query .= "WHERE ID=$pathway ";
			$DatabaseResult = mysql_query($Query, $DatabaseLink);
			$DatabaseRow = mysql_fetch_row($DatabaseResult);
			$isPrivate = $DatabaseRow[0];
	
			$MailBody .= "PATHWAY\n   $pathway_PlainName\n";
			$MailBody .= "   <http://www.leonatkinson.com/brain/index.php3?SCREEN=view&pathway=$pathway>\n\n";
			$MailBody .= "NODE\n   $inputTitle <http://www.leonatkinson.com/brain/location.php3?inputNode=$newnode>\n\n";
			$MailBody .= "DESCRIPTION\n   $inputDescription\n\n";
	
			if($isPrivate == "N")
			{
				$MailTo = "brain@onelist.com";
				$MailFrom = "leon@leonatkinson.com";
				$MailSubject = "$inputTitle";
	
	/*
				if(mail($MailTo, $MailSubject, $MailBody, "From: $MailFrom"))
				{
					$ActionResults .= "Sent!";
				}
				else
				{
					$ActionResults .= "Failed!";
				}
	*/			
			}
			else
			{
				$ActionResults .= "Private!";
			}
		}
		
	}
	else
	{
		$ActionResults = "File Upload Failed.";
	}
	

?>