<?php 

	include ('dbinfo.php');

    $functions .= "";
    $timeabc = microtime(); // do not change
	$blog1 = "#555555"; // Color for blog entries for the subject/date part
	$blog2 = "#DDDDDD"; // Color for blog entries for the actual blog part
	
	//THEMES
	$maintheme = "gamer"; //The folder in /templates that will be used for your sites main template
	$admintheme = "main"; //The folder in the admin /templates folder that will be used for the admin panel template
	$forumtheme = "gamer"; //The folder in forum/templates that will be used for the forum template

	// POINTS START

	$points1 = "2"; // amount of points awarded for each post
	$points2 = "3"; // amount of points awarded for each topic
	$points3 = "5"; // amount of points awarded for each user review
	$points4 = "1"; // amount of points awarded for each rating
	$points5 = "2"; // amount of points awarded for each comment
	$points6 = "1"; // amount of points awarded for each friend (verified)
	$points7 = "1"; // amount of points awarded for each tracked game
	$points8 = "1"; // amount of points awarded for each game added to collection
	$points9 = "1"; // amount of points awarded for each game added to wishlist
	$points10 = "1"; // amount of points awarded for each game added to playing
	$points11 = "1"; // amount of points awarded for each game added to favorites
	$points12 = "1"; // amount of points awarded for each system added to systems
	$ref = "1"; // amounts of points awarded for each time you are specified as a refferal

	$rex = explode(".", $_SERVER['HTTP_HOST']);

    if ($rex[2]) {
    $domain = $rex[1].".".$rex[2];
    } else {
    $domain = $rex[0].".".$rex[1];
    }
	$cpage = basename($_SERVER['PHP_SELF']);
	$setting[siteurl] = "http://".$_SERVER['HTTP_HOST'].str_replace("admin/","",str_replace($cpage, "", $_SERVER['PHP_SELF']));
	$page4 = explode("/", $_SERVER['REQUEST_URI']);
	$fpage = $page4[1];
	// POINTS END

	//-- DO NOT CHANGE ANYTHING BELOW THIS LINE UNLESS YOU KNOW WHAT YOU ARE DOING --
    if ($functions == "") {
    include ("functions.php");
	$info = new BrowserInfo($_SERVER['HTTP_USER_AGENT']);
	}
	$mysql = @mysql_select_db($dbname, @mysql_connect($dbhost, $dbuser, $dbpass));
	if (((($install == "") && ($dbname == "") or ($install == "") && (table($pre."users") == "")))) {
	header('location: install.php');
	die;
	}
    if (($install == "") && ($dbpass)) {
	if ($mysql == FALSE) {
    echo "Sorry but we are currently experiencing some issues, please try again in a moment. Thank you.";
    die;
    }
	
	//This fetches the settings data
	$query = mysql_query("SELECT * FROM ".$pre."settings WHERE type = 'setting'");
	while($row = mysql_fetch_array($query)) {
	$name = $row[name];

	$setting["$name"] = $row[data];
	$name = "";
	}
	
		//Old settings variables here for compatibility reasons, will be removed once everything is updated
		$template1[0] = "latestcontent";
		$template1[1] = "list2games";
		$template1[2] = "companies";
		$template2[0] = "Yes";
		$template2[1] = "No";

   // MOD REWRITE START - variables set for enable/disable feature

   if ($setting[modrewrite] == "Yes") {
   $cpart1 = $setting[siteurl]."game_";
   $cpart2 = ".html";
   $part1 = $setting[siteurl]."id";
   $part2 = ".html";
   $gamepart1 = $setting[siteurl]."game";
   $gamepart2 = ".html";
   $system1 = $setting[siteurl]."system_";
   $system2 = ".html";
   $ppart1 = $setting[siteurl]."company";
   $ppart2 = ".html";
   $pagepart1 = $setting[siteurl]."page_";
   $pagepart2 = ".html";
   $gpart1 = $setting[siteurl]."gallery";
   $gpart2 = ".html";
   $f1part1 = $setting[siteurl]."forum";
   $f1part2 = ".html";
   $f2part1 = $setting[siteurl]."topic";
   $f2part2 = ".html";
   $forumsurl = $setting[siteurl]."forums.html";
   $elite = $setting[siteurl]."elite.html";
   $elite1 = $setting[siteurl]."elite_";
   $elite2 = ".html";
   $staff1 = $setting[siteurl]."staff_";
   $staff2 = ".html";
   $staff = $setting[siteurl]."staff.html";
   $af = $setting[siteurl]."affiliates.html";
   $af_apply = $setting[siteurl]."affiliate_apply.html";
   $login = $setting[siteurl]."login.html";
   $register = $setting[siteurl]."register.html";
   $logout = $setting[siteurl]."logout.html";
   } else {
   $cpart1 = $setting[siteurl]."index.php?load=list&view=";
   $cpart2 = "";
   $part1 = $setting[siteurl]."index.php?load=content&id=";
   $part2 = "";
   $gamepart1 = $setting[siteurl]."index.php?load=content&game_id=";
   $gamepart2 = "";
   $system1 = $setting[siteurl]."index.php?load=systems&sid=";
   $system2 = "";
   $ppart1 = $setting[siteurl]."index.php?load=content&pr_id=";
   $ppart2 = "";
   $pagepart1 = $setting[siteurl]."index.php?load=pages&page=";
   $pagepart2 = "";
   $gpart1 = $setting[siteurl]."index.php?load=gallery&id=";
   $gpart2 = "";
   $f1part1 = $setting[siteurl]."boards.php?f=";
   $f1part2 = "";
   $f2part1 = $setting[siteurl]."boards.php?t=";
   $f2part2 = "";
   $forumsurl = $setting[siteurl]."boards.php";
   $elite = $setting[siteurl]."index.php?load=elite";
   $elite1 = $setting[siteurl]."index.php?load=elite&user=";
   $elite2 = "";
   $staff1 = $setting[siteurl]."index.php?load=staff&user=";
   $staff2 = "";
   $staff = $setting[siteurl]."index.php?load=staff";
   $af = $setting[siteurl]."index.php?load=af";
   $af_apply = $setting[siteurl]."index.php?load=af&view=apply";
   $login = $setting[siteurl]."index.php?load=members&view=login";
   $register = $setting[siteurl]."index.php?load=members&view=register";
   $logout = $setting[siteurl]."index.php?load=members&view=logout";
   }

   // MOD REWRITE END

   $time = time();
   $version = "2.6.4";

$stime = "15";
$thewidth = "500";
$theheight = "300";
$swidth = "516";
$sheight = "315";

if ($_POST['userreview']) {
$rex = explode("|", $_POST['userreview3']);
$rate1 = $rex[0] + 1;
$rate2 = $rex[1] + $_POST['userreview'];
$rate = $rate1."|".$rate2;
mysql_query("UPDATE ".$pre."userreviews SET rate = '".$rate."' WHERE id = '".$_POST['userreview2']."'");
$rate = "";
$rate1 = "";
$rate2 = "";
$rex = "";
}

    $stype2 = @mysql_num_rows(@mysql_query("SELECT * FROM ".$pre."stats WHERE ip = '".$_SERVER['REMOTE_ADDR']."'"));
	if ($stype2 == "0") {
	@mysql_query("INSERT INTO ".$pre."stats VALUES ('null', '".$fpage."', '".$_SERVER['HTTP_REFERER']."', 'unique', '".$cpage."', '".$_COOKIE[$pre."username"]."', '".$_SERVER['REMOTE_ADDR']."', '".$info->OS." ".$info->OS_Version."|".$info->Browser." ".$info->Browser_Version."', '".date("d")."', '".date("z")."', '".date("m")."', '".date("W")."', '".date("Y")."', '".time()."')");
	@mysql_query("INSERT INTO ".$pre."stats VALUES ('null', '".$fpage."', '".$_SERVER['HTTP_REFERER']."', 'view', '".$cpage."', '".$_COOKIE[$pre."username"]."', '".$_SERVER['REMOTE_ADDR']."', '".$info->OS." ".$info->OS_Version."|".$info->Browser." ".$info->Browser_Version."', '".date("d")."', '".date("z")."', '".date("m")."', '".date("W")."', '".date("Y")."', '".time()."')");
	} else {
	@mysql_query("INSERT INTO ".$pre."stats VALUES ('null', '".$fpage."', '".$_SERVER['HTTP_REFERER']."', 'view', '".$cpage."', '".$_COOKIE[$pre."username"]."', '".$_SERVER['REMOTE_ADDR']."', '".$info->OS." ".$info->OS_Version."|".$info->Browser." ".$info->Browser_Version."', '".date("d")."', '".date("z")."', '".date("m")."', '".date("W")."', '".date("Y")."', '".time()."')");
	}

if (($_COOKIE[$pre."username"]) && ($_COOKIE[$pre."password"])) {
if ($_POST['skin']) {
mysql_query("UPDATE ".$pre."users SET skin = '".$_POST['skin']."' WHERE username = '".$_COOKIE[$pre."username"]."'");
}
if ($_GET['fskin2']) {
mysql_query("UPDATE ".$pre."users SET skin2 = '".$_GET['fskin2']."' WHERE username = '".$_COOKIE[$pre."username"]."'");
}
if ($_COOKIE[login_date] == "") {
setcookie("login_date", time(), time()+24*3600*14);
}

$userfsprint = sprintf("SELECT level,email,skin,skin2,logged,warn,rank FROM ".$pre."users WHERE username = '%s' AND password = '%s'",
mysql_real_escape_string($_COOKIE[$pre."username"]),
mysql_real_escape_string($_COOKIE[$pre."password"]));
$userf = @mysql_fetch_row(mysql_query($userfsprint));
$level = $userf[0];
$email = $userf[1];
$skins = $userf[2];
$forumskin = $userf[3];
$logged = $userf[4];
$naum = $userf[5];
$myrank = $userf[6]; // fetches user info

$userflvl = @mysql_fetch_row(mysql_query("SELECT level FROM ".$pre."userlevels WHERE name = '".$level."'"));
$userlevel = $userflvl[0]; // fetches level number (1,2,3,4,5 or 6)
$leveltr = $userflvl[0];

$useridfsprint = sprintf("SELECT id FROM ".$pre."profile WHERE username = '%s'",
mysql_real_escape_string($_COOKIE[$pre."username"]));
$useridf = @mysql_fetch_row(mysql_query($useridfsprint));
if ($useridf[0]) {
$useridn = $useridf[0]; // fetches user id
} else {
$useridn = "";
}

$userfperm2 = sprintf("SELECT ver FROM ".$pre."permissions WHERE username = '%s'",
mysql_real_escape_string($_COOKIE[$pre."username"]));
$userfperm = @mysql_fetch_row(mysql_query($userfperm2));
$ver = $userfperm[0]; // fetches verification permission
}
}

// AUTH START...checks to see if user is logged in and if so the details are accurate
// also if user is not logged in they are taken to the login page

if (($lcheck == "") && ($install == "")) {
if ($_GET['load'] == "login") {
} else {
if (($_COOKIE[$pre."username"]) && ($_COOKIE[$pre."password"])) {
$logincount2 = sprintf("SELECT * FROM ".$pre."users WHERE username = '%s' AND password = '%s'",
mysql_real_escape_string($_COOKIE[$pre."username"]),
mysql_real_escape_string($_COOKIE[$pre."password"]));
$logincount = @mysql_num_rows(mysql_query($logincount2));
if ($logincount == "0") {
header('location: admin.php?load=login');
} else {
if ($userlevel > "5") { // MAKE SURE NOT A MEMBER
header('location: admin.php?load=login&login=no');
} else {
$auth = 1;
}
}
} else {
header('location: admin.php?load=login');
}
}
}
// AUTH END

// WARN/BAN CHECK START
if ($install == "") {
if (($j == "") && ($setting[warn] == $naum)) {
} else {
$sqlv = sprintf("SELECT * FROM ".$pre."users WHERE banadmin = 'yes' AND username = '%s' AND password = '%s'",
mysql_real_escape_string($_COOKIE[$pre."username"]),
mysql_real_escape_string($_COOKIE[$pre."password"]));
if ($_COOKIE[$pre."username"]) {
$numv = @mysql_num_rows(mysql_query($sqlv));
} else {
$numv = "0";
}

$ipbancheck1 = @mysql_num_rows(mysql_query("SELECT * FROM ".$pre."ipban WHERE ip = '".$_SERVER['REMOTE_ADDR']."' AND site = 'yes'"));
$ipbancheck2 = @mysql_num_rows(mysql_query("SELECT * FROM ".$pre."ipban WHERE ip = '".$_SERVER['REMOTE_ADDR']."' AND forums = 'yes'"));
$ipbancheck3 = @mysql_num_rows(mysql_query("SELECT * FROM ".$pre."ipban WHERE ip = '".$_SERVER['REMOTE_ADDR']."' AND cp = 'yes'"));

$sql2v = sprintf("SELECT * FROM ".$pre."users WHERE bansite = 'yes' AND username = '%s' AND password = '%s'",
mysql_real_escape_string($_COOKIE[$pre."username"]),
mysql_real_escape_string($_COOKIE[$pre."password"]));
if ($_COOKIE[$pre."username"]) {
$numvb = @mysql_num_rows(mysql_query($sql2v));
} else {
$numvb = "0";
}
}
}
// WARN/BAN CHECK END

//Following code courtesy of nodws
//Santizes POST, GET, Sessions, etc. Page might load slightly slower but the added security is a bonus. REMOVE AT YOUR OWN RISK!
function sanitize($var, $quotes = false) { 
        if (is_array($var)) {   //run each array item through this function (by reference)        
            foreach ($var as &$val) { 
                $val = sanitize($val); 
            } 
        } 
        else if (is_string($var)) { //clean strings 
            $var = mysql_real_escape_string($var); 
            if ($quotes) { 
                $var = "'". $var ."'"; 
            } 
        } 
        else if (is_null($var)) {   //convert null variables to SQL NULL 
            $var = "NULL"; 
        } 
        else if (is_bool($var)) {   //convert boolean variables to binary boolean 
            $var = ($var) ? 1 : 0; 
        } 
        return $var; 
    } 

	array_map('clean', $_GET);
	array_map('clean', $_POST);
	array_map('clean', $_COOKIE);
?>