1
include "connection.php";
2

3
  $query="select * from users where id=".intval($_GET['id']);
4
  $elves_rs=mysqli_query($db,$query);
5

6
  if(!$elves_rs)
7
  {
8
    echo "Error: Invalid SQL Query";
9
    die($query);
10
  }
11

12
  // Get the first result. There should be a single elf here.
13
  $elf=mysqli_fetch_assoc($elves_rs);
14

15
  //Now get the toys associated to this elf
16
  $query="select * from toys where creator_id=".intval($_GET['id']);
17
  $toys_rs=mysqli_query($db,$query);
18

19
  if(!$toys_rs)
20
  {
21
    echo "Error: Invalid SQL Query";
22
    die($query);
23
  }

1
$query="select * from toys where name like ? or description like ?";
2
$stmt = mysqli_prepare($db, $query);
3
$q = "%".$_GET['q']."%";
4
mysqli_stmt_bind_param($stmt, 'ss', $q, $q);
5
mysqli_stmt_execute($stmt);
6
$toys_rs=mysqli_stmt_get_result($stmt);
7

8
if(!$toys_rs)
9
{
10
  echo "Error: Invalid SQL Query";
11
  die($query);
12
}

1
include "connection.php";
2

3
$query="select * from toys where id=".intval($_GET['id']);
4
$toys_rs=mysqli_query($db,$query);
5

6
if(!$toys_rs)
7
{
8
  echo "Error: Invalid SQL Query";
9
  die($query);
10
}
11

12
// Get the first result. There should be a single elf here.
13
$toy=mysqli_fetch_assoc($toys_rs);
14

15
//query info on the creator elf
16
$query="select * from users where id=".intval($toy['creator_id']);
17
$elves_rs=mysqli_query($db,$query);
18

19
if(!$elves_rs)
20
{
21
  echo "Error: Invalid SQL Query";
22
  die($query);
23
}
24

25
// Get the first result. There should be a single elf here.
26
$elf=mysqli_fetch_assoc($elves_rs);
27

28
//query info on planned deliveries
29
$query="select * from kids where assigned_toy_id=".intval($_GET['id']);
30
$kids_rs=mysqli_query($db,$query);
31

32
if(!$kids_rs)
33
{
34
  echo "Error: Invalid SQL Query";
35
  die($query);
36
}

1
if(isset($_POST['username']) && isset($_POST['password'])){
2
  $username=$_POST['username'];
3
  $password=$_POST['password'];
4
  $query="select * from users where username=? and password=?";
5
  $stmt = mysqli_prepare($db, $query);
6
  mysqli_stmt_bind_param($stmt, 'ss', $username, $password);
7
  mysqli_stmt_execute($stmt);
8
  $users_rs=mysqli_stmt_get_result($stmt);
9

10
  if(mysqli_num_rows($users_rs)>0)
11
  {
12
    $_SESSION['username']=$username;
13
    echo "<script>window.location='admin.php';</script>";
14
  }
15
  else
16
  {
17
    $message="Incorrect username/password found!";
18
    echo "<script type='text/javascript'>alert('$message');</script>";
19
  }
20
}