<?php
  require_once 'conn.php';
  require_once 'http.php';
  
  if (isset($\_REQUEST[\text{'}action\text{'}]))\; \{\; switch\; ($_REQUEST['action']) {
      case 'Login':
        if (isset($\_POST[\text{'}email\text{'}])\; and\; isset($_POST['passwd']))
        {
          $sql\; =\; "SELECT\; user\_id,\; access\_lvl,name\; "\; .\; "FROM\; cms\_users\; "\; .\; "WHERE\; email=\text{'}"\; .$_POST['email'] . "' " .
                 "AND passwd='" . $\_POST[\text{'}passwd\text{'}]\; .\; "\text{'}";$result = mysql_query($sql,$conn)
            or die('Could not look up user information; ' . 
                   mysql_error());
  
          if ($row\; =\; mysql\_fetch\_array($result)) {
            session_start();
            $\_SESSION[\text{'}user\_id\text{'}]\; =$row['user_id'];
            $\_SESSION[\text{'}access\_lvl\text{'}]\; =$row['access_lvl'];
            $\_SESSION[\text{'}name\text{'}]\; =$row['name'];
          }
        }
        redirect('index.php');
        break;
  
      case 'Logout':
        session_start();
        session_unset();
        session_destroy();
  
        redirect('index.php');
        break;
  
      case 'Create Account':
        if (isset($\_POST[\text{'}name\text{'}])\; and\; isset($_POST['email'])
            and isset($\_POST[\text{'}passwd\text{'}])\; and\; isset($_POST['passwd2'])
            and $\_POST[\text{'}passwd\text{'}]\; ==$_POST['passwd2'])
        {
          $sql\; =\; "INSERT\; INTO\; cms\_users\; (email,\; name,\; passwd)\; "\; .\; "VALUES\; (\text{'}"\; .$_POST['email'] . "','" . 
                 $\_POST[\text{'}name\text{'}]\; .\; "\text{'},\text{'}"\; .$_POST['passwd'] . "')";
  
          mysql_query($sql,$conn)
            or die('Could not create user account; ' . mysql_error());
  
          session_start();
          $\_SESSION[\text{'}user\_id\text{'}]\; =\; mysql\_insert\_id($conn);
          $\_SESSION[\text{'}access\_lvl\text{'}]\; =\; 1;$_SESSION['name'] = $\_POST[\text{'}name\text{'}];\; \}\; redirect(\text{'}index.php\text{'});\; break;\; case\; \text{'}Modify\; Account\text{'}:\; if\; (isset($_POST['name'])
            and isset($\_POST[\text{'}email\text{'}])\; and\; isset($_POST['accesslvl'])
            and isset($\_POST[\text{'}userid\text{'}]))\; \{$sql = "UPDATE cms_users " .
                 "SET email='" . $\_POST[\text{'}email\text{'}]\; .\; "\text{'},\; name=\text{'}"\; .$_POST['name'] . 
                 "', access_lvl=" . $\_POST[\text{'}accesslvl\text{'}]\; .\; "\; "\; .\; "\; WHERE\; user\_id="\; .$_POST['userid'];
  
          mysql_query($sql,$conn)
            or die('Could not update user account; ' . mysql_error());
        }
        redirect('admin.php');
        break;
  
      case 'Send my reminder!':
        if (isset($\_POST[\text{'}email\text{'}]))\; \{$sql = "SELECT passwd FROM cms_users " .
                 "WHERE email='" . $\_POST[\text{'}email\text{'}]\; .\; "\text{'}";$result = mysql_query($sql,$conn)
            or die('Could not look up password; ' . mysql_error());
  
          if (mysql_num_rows($result))\; \{$row = mysql_fetch_array($result);$subject = 'Comic site password reminder';
            $body\; =\; "Just\; a\; reminder,\; your\; password\; for\; the\; "\; .\; "Comic\; Book\; Appreciation\; site\; is:\; "\; .$row['passwd'] .
                    "\n\nYou can use this to log in at http://" .
                    $\_SERVER[\text{'}HTTP\_HOST\text{'}]\; .\; dirname($_SERVER['PHP_SELF']) . '/';
  
            mail($\_POST[\text{'}email\text{'}],$subject, $body)\; or\; die(\text{'}Could\; not\; send\; reminder\; email.\text{'});\; \}\; \}\; redirect(\text{'}login.php\text{'});\; break;\; case\; \text{'}Change\; my\; info\text{'}:\; session\_start();\; if\; (isset($_POST['name'])
            and isset($\_POST[\text{'}email\text{'}])\; and\; isset($_SESSION['user_id']))
        {
          $sql\; =\; "UPDATE\; cms\_users\; "\; .\; "SET\; email=\text{'}"\; .$_POST['email'] . 
                 "', name='" . $\_POST[\text{'}name\text{'}]\; .\; "\text{'}\; "\; .\; "WHERE\; user\_id="\; .$_SESSION['user_id'];
  
          mysql_query($sql,$conn)
            or die('Could not update user account; ' . mysql_error());
        }
        redirect('cpanel.php');
        break;
    }
  }
  ?>