<? include("../../inc/topa.php"); ?>
<!-- START BODY -->
        <td colspan="12" class="white">
            <center><b>Admin Area</b></center><br>
            Add Product Line:<br>
            <?
            require("../../inc/puppies.php");
            switch (@$_GET['do'])
            {
                default:
                    echo "<form action='?do=step2' method='post'><br>
                        Name: <input type='text' name='newname'><br>
                        Picture: <input type='text' name='newpic'><br>
                        <input type='submit' value='Submit'>
                        </form>";
                    break;
                    
                case "step2":
                    $newname = $_POST['newname'];
                    $newpic = $_POST['newpic'];
                    if (!empty($newpic))
                    {
                        $urlf = "<img src=$newpic>";
                    } else
                    {
                        $urlf = " ";
                    }
                    $add = mysql_query("INSERT INTO products (name, img, url) VALUES ('$newname','$newpic','$urlf')") or die("Couldn't add product line.");
                    echo "Product line added.";
                    break;
            }
            ?>
        </td>
<!-- END BODY -->
<? include("../../inc/bottoma.php"); ?>

<?php
function check_input($value)
{
// Stripslashes
if (get_magic_quotes_gpc())
  {
  $value = stripslashes($value);
  }
// Quote if not a number
if (!is_numeric($value))
  {
  $value = "'" . mysql_real_escape_string($value) . "'";
  }
return $value;
}

$con = mysql_connect("localhost", "peter", "abc123");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

// Make a safe SQL
$user = check_input($_POST['user']);
$pwd = check_input($_POST['pwd']);
$sql = "SELECT * FROM users WHERE
user=$user AND password=$pwd";

mysql_query($sql);

mysql_close($con);
?>