<?php
  // include shared code
  include '../lib/common.php';
  include '../lib/db.php';
  include '../lib/functions.php';
  include '../lib/User.php';
  
  // 401 file included because user should be logged in to access this page
  include '401.php';
  
  // user must have appropriate permissions to use this page
  $user\; =\; User::getById($_SESSION['userId']);
  if (~<p>Sorry, you do not have sufficient privileges to create new ' .
          'forums.</p>');
  }
  
  // validate incoming values
  forum_name = (isset($\_POST[\text{'}forum\_name\text{'}]))\; ?\; trim($_POST['forum_name']) : '';
  $forum\_desc\; =\; (isset($_POST['forum_desc'])) ? trim($\_POST[\text{'}forum\_desc\text{'}])\; :\; \text{'}\text{'};$// add entry to the database if the form was submitted and the necessary
  // values were supplied in the form
  if (isset(_POST['submitted']) && forum_desc)
  {
      $query\; =\; sprintf(\text{'}INSERT\; INTO$\%sFORUM (FORUM_NAME, DESCRIPTION) ' .
          'VALUES ("\%s", "\%s")', DB_TBL_PREFIX,
          mysql_real_escape_string(forum_name, $GLOBALS[\text{'}DB\text{'}]),\; mysql\_real\_escape\_string($forum_desc, $GLOBALS[\text{'}DB\text{'}]));\; mysql\_query($query, $GLOBALS[\text{'}DB\text{'}]);$// redirect user to list of forums after new record has been stored
      header('Location: view.php');
  }
  
  // form was submitted but not all the information was correctly filled in
  else if (isset(_POST['submitted']))
  {
      $message\; =\; \text{'}$<p>Not all information was provided.  Please correct ' .
          'and resubmit.</p>';
  }
  
  // generate the form
  ob_start();
  if (isset(message))
  {
      echo $message;\; \}\; ?>$<form action="<?php htmlspecialchars(_SERVER['PHP_SELF']); ?>"
   method="post">
   <div>
    <label for="forum_name">Forum Name:</label>
    <input type="input" id="forum_name" name="forum_name" value="<?php
     echo htmlspecialchars($forum\_name);\; ?>"/>$<br/>
    <label for="forum_desc">Description:</label>
    <input type="input" id="forum_desc" name="forum_desc" value="<?php
     echo htmlspecialchars(forum_desc); ?>"/>
    <br/>
    <input type="hidden" name="submitted" value="true"/>
    <input type="submit" value="Create"/>
   </div>
  </form>
  <?php
  $GLOBALS[\text{'}TEMPLATE\text{'}][\text{'}content\text{'}]\; =\; ob\_get\_clean();$// display the page
  include '../templates/template-page.php';
  ?>