Файл: modules/friends/add.php
Строк: 43
<?php
if(!isset($user) || !isset($_GET['id']) || $_GET['id'] == 0 || $_GET['id'] == $user['id'] || $db->query("SELECT * FROM `friends` WHERE `friend_id` = '". abs(intval($_GET['id'])) ."' AND `user_id` = '". $user['id'] ."'")->rowCount() !=0 || $db->query("SELECT * FROM `friends` WHERE `user_id` = '". abs(intval($_GET['id'])) ."' AND `friend_id` = '". $user['id'] ."'")->rowCount() !=0)
{
header('location: /');
exit;
}
if(isset($_GET['id']) && isset($_POST['no']))
{
header('location: /user/'. abs(intval($_GET['id'])));
exit;
}
elseif(isset($_GET['id']) && isset($_POST['yes']))
{
$db->query("INSERT INTO `friends` SET `user_id` = '" .$user['id'] ."', `friend_id` = '". abs(intval($_GET['id'])) ."', `active` = '0'");
header('location: /user/'. abs(intval($_GET['id'])));
exit;
}
$title = $lang->word('friends_add');
require_once(SYS.'/view/header.php');
$tpl->div('title', $lang->word('friends_add'));
echo '<div class="menu">
<form action="/friends/add/'.abs(intval($_GET['id'])) .'?act=last" method="post">
'. $lang->word('friends_verify_add').' <b>'.tnick(abs(intval($_GET['id']))).'</b>?<br/>
<input type="submit" name="yes" value="'.$lang->word('yyes').'" /> <input type="submit" name="no" value="'. $lang->word('yno').'" />
</form>
</div>';
$tpl->div('block', NAV .'<a href="/user/'. abs(intval($_GET['id'])) .'">'. $lang->word('back') .'</a><br/>'
. HICO .'<a href="/">'. $lang->word('home') .'</a>');
require_once(SYS .'/view/footer.php');
?>