<?

	/* 
	** if we have necessary fields, passwords match, and have permission, add vote
	*/
	
	if($UserInfo["Admin"] || $UserInfo["ID"] == $UserID)
	{
		if ($inputPassword1 == $inputPassword2)
		{
			if ($inputLogin != "" && $inputFirstName != "" && $inputLastName != "" && $inputEmail != "")
			{
				// strip HTML tags from user input to guard against hacking
		
				$inputLogin = strip_tags($inputLogin);
				$inputPassword1 = strip_tags($inputPassword1);
				$inputFirstName = strip_tags($inputFirstName);
				$inputLastName = strip_tags($inputLastName);
				$inputEmail = strip_tags($inputEmail);
				
				$Query = "UPDATE user ";
				$Query .= "SET Login='" . addslashes($inputLogin) . "', ";
				$Query .= "Password='" . addslashes($inputPassword1) . "', ";
				$Query .= "FirstName='" . addslashes($inputFirstName) . "', ";
				$Query .= "LastName='" . addslashes($inputLastName) . "', ";
				$Query .= "Email='" . addslashes($inputEmail) . "' ";
				$Query .= "WHERE ID=$UserID ";
				
				$DatabaseResult = mysql_query($Query, $DatabaseLink);
				if(!$DatabaseResult)
				{
					$ActionResults .= "Edit failed: " . mysql_error();
				}
				else
				{
					$Query = "DELETE FROM user_permission ";
					$Query .= "WHERE User=$UserID ";
					
					$DatabaseResult = mysql_query($Query, $DatabaseLink);
					
					if (isset($inputPermission) && list($key) = each($inputPermission))
					{
						
						$Query = "INSERT INTO user_permission VALUES (";
						$Query .= "$UserID, $key)";
						
						while (list($key) = each($inputPermission))
						{
							$Query .= ", ($UserID, $key)";
						}
						
					$DatabaseResult = mysql_query($Query, $DatabaseLink);
					
					}
					
					$ActionResults = "User Edited!";
				}
			}
			else
			{
				$ActionResults .= "All fields are required.";
			}
		
		}
		else
		{
			$ActionResults .= "Passwords didn't match.  Please try again.";
		}
	}