<?php
$lcheck = "b";
$z = "b";
eval (" ?>" . headera() . " <?php ");
if ($_GET['load'] == "contest") {
if ((is_numeric($_GET['id'])) && ($_GET['show'] == "")) {

$query="SELECT * FROM ".$pre."templates WHERE name = 'Contest Manager'";
$result=mysql_query($query);
while($row = mysql_fetch_array($result)) {
$contest = stripslashes($row[template]);
}

$query="SELECT * FROM ".$pre."contest WHERE id = '".$_GET['id']."'";
	$result=mysql_query($query);
	while($row2 = mysql_fetch_array($result)) {
		$postpone = "$row2[email]";

	$find[] = "/{rules}/";
	$find[] = "/{des}/";
	$find[] = "/{name}/";
	$find[] = "/{priv}/";
	$find[] = "/{posts}/";
	$find[] = "/{login}/";
	$find[] = "/{register}/";
	$find[] = "/{forums}/";
	$find[] = "/{enter}/";
	$repl[] = stripslashes($row2[rules]);
	$repl[] = stripslashes($row2[des]);
	$repl[] = $row2[name];
	$repl[] = $row2[priv];
	$repl[] = $row2[posts];
	$repl[] = $login;
	$repl[] = "".$register."";
	$repl[] = "boards.php";
	$repl[] = "index.php?load=contest&id=".$_GET['id']."&show=enter";

if ($postpone > date("YmdHi")) {
eval (" ?>" . preg_replace($find, $repl, $contest) . " <?php ");
} else {

    $query="SELECT * FROM ".$pre."contest WHERE type = 'entry' AND cid = '".$_GET['id']."' ORDER BY RAND() LIMIT 1";
	$result=mysql_query($query);
	while($rowb = mysql_fetch_array($result)) {
		$win = "$rowb[username]";
	}

	$update = mysql_query("UPDATE ".$pre."contest SET type = 'winner' WHERE username = '".$win."' AND cid = '".$_GET['id']."'");
}
	$queraey=mysql_query("SELECT * FROM ".$pre."contest WHERE cid = '".$_GET['id']."' AND type = 'winner'");
	$countn = mysql_num_rows($queraey);
	if ($countn == "1") {
	$queraeya="SELECT * FROM ".$pre."contest WHERE cid = '".$_GET['id']."' AND type = 'winner'";
	$result=mysql_query($queraeya);
	while($row = mysql_fetch_array($result)) {
		$winner = "$row[username]";
	}
	echo "Sorry, but this contest is over. The winner is: <b>".$winner."</b>";
	$queraeye="SELECT * FROM ".$pre."profile WHERE id = '".$winner."'";
	$resulta=mysql_query($queraeye);
	while($rowe = mysql_fetch_array($resulta)) {
		print $rowe[username];
	}
	echo "</a>";
	}
	}
}

if ((is_numeric($_GET['id'])) && ($_GET['show'] == "enter")) {
	$query="SELECT * FROM ".$pre."contest WHERE id = '".$_GET['id']."'";
	$result=mysql_query($query);
	while($row2 = mysql_fetch_array($result)) {
		$priv = "$row2[priv]";
		$posts = "$row2[posts]";
		$name = "$row2[name]";
	}
	echo '<SCRIPT LANGUAGE="JavaScript">
function validateZIP(field) {
var valid = "0123456789-";
var hyphencount = 0;

if (field.length!=5 && field.length!=10) {
alert("Please enter your 5 digit or 5 digit+4 zip code.");
return false;
}
for (var i=0; i < field.length; i++) {
temp = "" + field.substring(i, i+1);
if (temp == "-") hyphencount++;
if (valid.indexOf(temp) == "-1") {
alert("Invalid characters in your zip code.  Please try again.");
return false;
}
if ((hyphencount > 1) || ((field.length==10) && ""+field.charAt(5)!="-")) {
alert("The hyphen character should be used with a properly formatted 5 digit+four zip code, like 12345-6789.   Please try again.");
return false;
   }
}
return true;
}
</script>';

$findba = mysql_query("SELECT * FROM ".$pre."contest WHERE username = '".$_COOKIE[$pre."username"]."' AND type = 'entry' AND cid = '".$_GET['id']."'");
$check2 = mysql_num_rows($findba);

$find2ba = mysql_query("SELECT * FROM ".$pre."contest WHERE ip = '".$_SERVER['REMOTE_ADDR']."' AND type = 'entry' AND cid = '".$_GET['id']."'");
$check3 = mysql_num_rows($find2ba);

$findbae = mysql_query("SELECT * FROM ".$pre."contest WHERE type = 'winner' AND cid = '".$_GET['id']."'");
$check2e = mysql_num_rows($findbae);

if ($check2e > "0") {
	$queraeya="SELECT * FROM ".$pre."contest WHERE cid = '".$_GET['id']."' AND type = 'winner'";
	$result=mysql_query($queraeya);
	while($row = mysql_fetch_array($result)) {
		$winner = "$row[username]";
	}
	echo "Sorry, but this contest is over. The winner is: <b><a href='index.php?load=members&action=profile&id=".$winner."'>";
	$queraeye="SELECT * FROM ".$pre."profile WHERE id = '".$winner."'";
	$resulta=mysql_query($queraeye);
	while($rowe = mysql_fetch_array($resulta)) {
		print $rowe[username];
	}
	echo "</a>";
} else {


if (($check2 == "0") or ($check3 == "0")) {
	echo "<form action='index.php?load=contest&show=enter2&id=".$_GET['id']."' method='post' onSubmit='return validateZIP(this.zip.value)'><table cellspacing=\"0\" cellpadding=\"3\" border=\"0\" align=\"center\"><tr><td><b>Your Name</b></td><td><input type='text' name='name'></td></tr>";
	
	if (($priv == "yes") && ($_COOKIE[$pre."username"])) {
		echo "<tr><td><b>Your Username</b></td><td>".$_COOKIE[$pre."username"]."</td></tr><tr><td><b>Your E-mail Address</b></td><td><input type='hidden' name='email' value='".$email."'>".$email."</td></tr>";
	}
	
	if (($priv == "yes") && ($_COOKIE[$pre."username"] == "")) {
		echo "<tr><td><b>Your Username</b></td><td><font color='red'>Sorry, but you must be a member of ".$sitename." in order to enter. Please <a href='".$register."'>Register</a> or <a href='".$login."'>Login</a></td></tr>";
	}

	if (($priv == "no") && ($_COOKIE[$pre."username"] == "")) {
		echo "<tr><td><b>Your E-mail Address</b></td><td><input type='text' name='email'></td></tr>";
	}

	if (($priv == "no") && ($_COOKIE[$pre."username"])) {
		echo "<tr><td><b>Your E-mail Address</b></td><td><input type='hidden' name='email' value='".$email."'>".$email."</td></tr>";
	}

	echo "<tr><td><b>Street Address</b></td><td><input type='text' name='addy'></td></tr><tr><td><b>City</b></td><td><input type='text' name='city'></td></tr><tr><td><b>State</b></td><td><input type='text' name='state'></td></tr><tr><td><b>Zip Code</b></td><td><input type='text' name='zip' size='5'></td></tr><tr><td><input type='checkbox' name='check' checked></td><td>I agree to the official rules and all information entered is not false.</td></tr><tr><td><input type='submit' value='Submit Entry'></td></tr>";
} else {
	echo "Sorry, but you have already entered into the <b>".$name."</b> contest";
}
}
echo "</table>";
}

if ((is_numeric($_GET['id'])) && ($_GET['show'] == "enter2")) {
	if ($_POST['check'] == "") {
		echo "Sorry, but you must agree to the rules. Please go back and try again.";
	} else {
	$enter = mysql_query("INSERT INTO ".$pre."contest VALUES ('null', '".$_POST["name"]."', '".$_POST["addy"]."', '".$_POST["email"]."', 'entry', '".$_POST["city"]."', '".$_POST["state"]."', '".$_POST["zip"]."', '".$_COOKIE[$pre."username"]."', '".$_SERVER['REMOTE_ADDR']."', '".$_GET['id']."')") or die(mysql_error());

	if ($enter == TRUE) {
		echo "Congratulations ".$_POST["name"].", you have successfully entered the contest. You will be notified if you win. Thank you.";
	}
	}
}
eval (" ?>" . footera() . " <?php ");
}
?>