<?

	/* 
	** if we have necessary fields, passwords match, and have permission, add vote
	*/
	
	if($UserInfo["Admin"])
	{
		if ($inputPassword1 == $inputPassword2)
		{
			if ($inputLogin != "" && $inputFirstName != "" && $inputLastName != "" && $inputEmail != "")
			{
				// strip HTML tags from user input to guard against hacking
		
				$inputLogin = strip_tags($inputLogin);
				$inputPassword1 = strip_tags($inputPassword1);
				$inputFirstName = strip_tags($inputFirstName);
				$inputLastName = strip_tags($inputLastName);
				$inputEmail = strip_tags($inputEmail);
	
				
				$Query = "INSERT INTO user VALUES (NULL, ";
				$Query .= "'" . addslashes($inputLogin) . "', ";
				$Query .= "'" . addslashes($inputPassword1) . "', ";
				$Query .= "'" . addslashes($inputFirstName) . "', ";
				$Query .= "'" . addslashes($inputLastName) . "', ";
				$Query .= "'" . addslashes($inputEmail) . "') ";
				
				$DatabaseResult = mysql_query($Query, $DatabaseLink);
				if(!$DatabaseResult)
				{
					$ActionResults .= "Add failed: " . mysql_error();
				}
				else
				{
					$newID = mysql_insert_id($DatabaseLink);
					
					if (isset($inputPermission) && list($key) = each($inputPermission))
					{
						$Query = "INSERT INTO user_permission VALUES (";
						$Query .= "$newID, $key)";
						
						while (list($key) = each($inputPermission))
						{
							$Query .= ", ($newID, $key)";
						}
						
					$DatabaseResult = mysql_query($Query, $DatabaseLink);
					
					}
					
					$ActionResults = "User Added!";
				}
			}
			else
			{
				$ActionResults .= "All fields are required.";
				$prepopulate = TRUE;
			}
		
		}
		else
		{
			$ActionResults .= "Passwords didn't match.  Please retype passwords.";
			$prepopulate = TRUE;
		}
	}