<?php
    //-----------------------------------------------------------------------------------------------
    // blog.php
    //
    // implements the blur6ex blog capabilities
    //
    //
    //
    //
    //
    //----------------------------------------------------------------------------------------------
    global $siteSettings;
     
     
     
    // Get permissions *once*
    if (isInGroup($CURRENTUSER, "admin"))
    {
        $verifyEditDelete = true;
    }
    else
    {
        $verifyEditDelete = false;
    }
     
     
     
     
     
    //-------------------------------------------------------------------------------------
    // date_line -- handle the display of the date below the post title
    //-------------------------------------------------------------------------------------
    function date_line($row )
    {
        global $siteSettings;
        switch($siteSettings['datestyle'] ):
         
        case "minimal":
        print("<small>" . date("d F Y" , $row['date']) . "</small><br /><br />");
        break;
        case "short":
        print("<small>" . date("d F Y  h:i a" , $row['date']) . "</small><br /><br />");
        break;
        case "full":
        print("<small>Posted by " . $row['user'] . " at " . date("g:ia l, F dS, Y", $row['date']) . "</small><br /><br />");
        break;
        endswitch;
    }
     
     
     
    //-------------------------------------------------------------------------------------
    // blog_footer -- display the Trackback, Comments, Edit, Delete, etc at the bottom
	// 
	// for now, if you don't want to display Comments or Trackbacks, delete the part of
	// the print statement below that prints it out.
    //-------------------------------------------------------------------------------------
    function blog_footer($row , $comment_count )
    {
        global $siteSettings;
        global $shard;
        global $CURRENTUSER;
        // I tried to just make verifyEditDelete global but it wasn't working so
        // I had to put the whole test in here...which required a global CURRENTUSER
        if (isInGroup($CURRENTUSER, "admin"))
        {
            $verifyEditDelete = true;
        }
        else
        {
            $verifyEditDelete = false;
        }
         
        // if Category is empty, set it to Unfiled 
        $cat = $row['category'];
        if ($cat == '' )
			$cat = 'Unfiled';
        
		
		// set the Category URL for use later
        if ($siteSettings['slickurls'] == TRUE )
			$caturl = "<a href='" . $siteSettings['siteurl'] . "/category/$cat'>" . $cat . "</a>";
        else
            $caturl = "<a href='index.php?shard=blog&amp;action=g_category&amp;category=$cat'>" . $cat . "</a>";
         
         
        $tbresult = mysql_query("SELECT COUNT(refID) FROM trackbacks WHERE refID = " . $row['ID'] );
        $tbarray = mysql_fetch_row($tbresult );
        $tb_count = $tbarray[ 0 ];
         
		// set the Trackback URL for use later
        if ($siteSettings['slickurls'] == TRUE )
			$trackback = "<a href='" . $siteSettings['siteurl'] . "/blog/trackback/" . $row['ID'] . "'>Trackback (" . $tb_count . ")</a>";
        else
            $trackback = "<a href='index.php?shard=trackback&amp;action=g_default&amp;id=$row[ID]'>Trackback (" . $tb_count . ")</a>";
         
         
        print("<small>");
         
        if ($siteSettings['slickurls'] == TRUE )
        {
            print "$caturl | $trackback | <a href='" . $siteSettings['siteurl'] . "/blog/" . $row['ID']. "/comments'>Comments (" . $comment_count . ")</a> |
                <a href='" . $siteSettings['siteurl'] . "/blog/" . $row['ID'] . "/reply'>Reply</a> | ";
        }
        else
		{
            print "$caturl | $trackback | <a href='index.php?shard=$shard&amp;action=g_comments&amp;ID=$row[ID]'>Comments (" . $comment_count . ")</a> |
                <a href='index.php?shard=$shard&amp;action=g_reply&amp;ID=$row[ID]#bottom'>Reply</a> |";
        }
        if ($verifyEditDelete)
        {
            if ($siteSettings['slickurls'] == TRUE )
            {
                print "<a href='" . $siteSettings['siteurl'] . "/index.php?shard=blog&amp;action=g_edit&amp;ID=" . $row['ID']. "'> Edit</a> |
                    <a href='" . $siteSettings['siteurl'] . "/index.php?shard=blog&amp;action=delete&amp;ID=" . $row['ID'] . "'>Delete</a> |";
            }
            else
            {
                print "<a href='index.php?shard=blog&amp;action=g_edit&amp;ID=" . $row['ID']. "'> Edit</a> |
                    <a href='index.php?shard=blog&amp;action=delete&amp;ID=" . $row['ID'] . "'>Delete</a> |";
            }
             
        }
         
        print("</small>");
         
    }
     
     
     
     
     
     
    //---------------------------------------------------------------------------------------------------------
    // Determine blog action request
    //---------------------------------------------------------------------------------------------------------
    switch ($action):
     
     
    //-------------------------------------------------------------------------------------
    // g_default -- default display of blog
    //-------------------------------------------------------------------------------------
    case "g_default":
     
    //Get blogs according to a user's permission group and access rules
     
    $blogs = mysql_query("select blog.*, users.avatar from blog LEFT JOIN permissions ON permissions.objectID=blog.ID
        LEFT JOIN permissionGroups ON blog.permission = permissionGroups.pGroup LEFT JOIN users ON users.username=blog.user
        where ((permissions.action <> 'denyView' or permissions.action IS NULL) or (permissions.username
        <> '" . $CURRENTUSER . "' or permissions.username IS NULL)) and (permissionGroups.username='".$CURRENTUSER."') and
        (blog.replyID =0) order by blog.date desc limit 0,10") or DIE(mysql_error());
     
     
    while ($row = mysql_fetch_array($blogs) )
    {
        $comresult = mysql_query("SELECT COUNT(threadID) FROM blog WHERE threadID = " . $row['ID'] );
        $comarray = mysql_fetch_row($comresult );
        $comment_count = $comarray[ 0 ];
        
		$formattedBody = format_post($row['body']);
         
        
            drawMainTop();
             
            //Get user's posting information!
            //$posterInfo = mysql_query("select avatar, location, datejoined from users where username='$row[user]'") or die(mysql_error());
            //$posterInfo = mysql_fetch_array($posterInfo);
            if ($siteSettings['slickurls'] == TRUE )
            {
                print("<h2><a href='" . $siteSettings['siteurl'] . "/blog/" . $row['ID'] . "'>" . $row['title'] . "</a></h2>");
            }
            else
                print("<h2><a href='index.php?shard=" . $shard . "&amp;action=g_permaPost&amp;ID=" . $row['ID'] . "'>" . $row['title'] . "</a></h2>");
             
            date_line($row );
             
            draw_pre_post();
            print($formattedBody . '<br />' );
            draw_post_post();
             
            //$numComments = mysql_query("select count(*) as expr1 from blog where threadID=".$row['ID']) or DIE(mysql_error());
            //$numComments = mysql_fetch_array($numComments);
            blog_footer($row , $comment_count );
        
			drawMainBottom();
         
    }
     
    //drawMainBottom();
    break;
     
     
     
     
    //-------------------------------------------------------------------------------------
    // g_category -- grab a category of blogs
    //-------------------------------------------------------------------------------------
    case "g_category":
     
     
    $category = $_GET['category'];
    if ($category == 'Unfiled' )
    {
        //Get blogs according to a user's permission group and access rules
        $blogs = mysql_query("SELECT blog.*, users.avatar FROM
            blog LEFT JOIN permissions ON permissions.objectID=blog.ID LEFT JOIN permissionGroups ON blog.permission = permissionGroups.pGroup
            LEFT JOIN users ON users.username=blog.user
            WHERE ((permissions.action <> 'denyView' or permissions.action IS NULL) or (permissions.username
            <> '" . $CURRENTUSER . "' or permissions.username IS NULL)) and (permissionGroups.username='".$CURRENTUSER."') and
            (blog.replyID = 0) and (blog.category is NULL ) order by blog.date desc") or DIE(mysql_error());
    }
    else
        {
        //Get blogs according to a user's permission group and access rules
        $blogs = mysql_query("SELECT blog.*, users.avatar FROM
            blog LEFT JOIN permissions ON permissions.objectID=blog.ID LEFT JOIN permissionGroups ON blog.permission = permissionGroups.pGroup
            LEFT JOIN users ON users.username=blog.user
            WHERE ((permissions.action <> 'denyView' or permissions.action IS NULL) or (permissions.username
            <> '" . $CURRENTUSER . "' or permissions.username IS NULL)) and (permissionGroups.username='".$CURRENTUSER."') and
            (blog.replyID = 0) and (blog.category = '$category' ) order by blog.date desc") or DIE(mysql_error());
    }
     
    while ($row = mysql_fetch_array($blogs ) )
    {
        $comresult = mysql_query("SELECT COUNT(threadID) FROM blog WHERE threadID = " . $row['ID'] );
        $comarray = mysql_fetch_row($comresult );
        $comment_count = $comarray[ 0 ];
         
         
        $formattedBody = format_post($row['body']);
        drawMainTop();
         
        //Get user's posting information!
        //$posterInfo = mysql_query("select avatar, location, datejoined from users where username='$row[user]'") or die(mysql_error());
        //$posterInfo = mysql_fetch_array($posterInfo);
        if ($siteSettings['slickurls'] == TRUE )
        {
            print("<h2><a href='" . $siteSettings['siteurl'] . "/blog/" . $row['ID'] . "'>" . $row['title'] . "</a></h2>");
        }
        else
            print("<h2><a href='index.php?shard=" . $shard . "&amp;action=g_permaPost&amp;ID=" . $row['ID'] . "'>" . $row['title'] . "</a></h2>");
         
         
        date_line($row );
         
         
        draw_pre_post();
        print($formattedBody . '<br />' );
        draw_post_post();
         
         
        //$numComments = mysql_query("select count(*) as expr1 from blog where threadID=".$row['ID']) or DIE(mysql_error());
        //$numComments = mysql_fetch_array($numComments);
         
        blog_footer($row , $comment_count );
         
        drawMainBottom();
         
    }
     
     
    break;
     
     
     
     
     
     
    //-------------------------------------------------------------------------------------
    // g_archived -- grab a month's worth of blogs
    //-------------------------------------------------------------------------------------
    case "g_archived":
     
     
    $a_year = $_GET['year'];
    $a_month = $_GET['month'];
     
    $nmonth = get_numeric_month($a_month );
    $numdays = days_in_month($nmonth , $a_year );
     
     
     
    $start_timestamp = mktime(0, 0, 0, $nmonth, 1, $a_year );
    $end_timestamp = mktime(0, 0, 0, $nmonth, $numdays , $a_year );
     
     
    //Get blogs according to a user's permission group and access rules
    $blogs = mysql_query("SELECT blog.*, users.avatar FROM
        blog LEFT JOIN permissions ON permissions.objectID=blog.ID LEFT JOIN permissionGroups ON blog.permission = permissionGroups.pGroup
        LEFT JOIN users ON users.username=blog.user
        WHERE ((permissions.action <> 'denyView' or permissions.action IS NULL) or (permissions.username
        <> '" . $CURRENTUSER . "' or permissions.username IS NULL)) and (permissionGroups.username='".$CURRENTUSER."') and
        (blog.replyID = 0) and (blog.date BETWEEN '". $start_timestamp ."' and '".$end_timestamp."') order by blog.date desc") or DIE(mysql_error());
     
     
     
     
    //Print out posts
    //drawMainTop();
    while ($row = mysql_fetch_array($blogs) )
    {
        $comresult = mysql_query("SELECT COUNT(threadID) FROM blog WHERE threadID = " . $row['ID'] );
        $comarray = mysql_fetch_row($comresult );
        $comment_count = $comarray[ 0 ];
         
        $formattedBody = format_post($row['body']);
        
            drawMainTop();
             
            if ($siteSettings['slickurls'] == TRUE )
            {
                print("<h2><a href='" . $siteSettings['siteurl'] . "/blog/" . $row['ID'] . "'>" . $row['title'] . "</a></h2>");
            }
            else
                print("<h2><a href='index.php?shard=" . $shard . "&amp;action=g_permaPost&amp;ID=" . $row['ID'] . "'>" . $row['title'] . "</a></h2>");
             
            date_line($row );
             
             
            draw_pre_post();
            print($formattedBody . '<br />' );
            draw_post_post();
             
            blog_footer($row , $comment_count );
            drawMainBottom();
        
         
    }
     
    //drawMainBottom();
    break;
     
     
     
     
     
    //-------------------------------------------------------------------------------------
    // g_comments - show post and comments, no QuickQuote buttons
    //-------------------------------------------------------------------------------------
    case "g_comments":
     
    if (verify($CURRENTUSER, $_REQUEST['ID'], 'denyView'))
        {
        // Get all posts for this thread
        $parentBlog = mysql_query("SELECT blog.*, users.avatar FROM blog LEFT JOIN permissions ON permissions.objectID=blog.ID
            LEFT JOIN permissionGroups ON
            blog.permission = permissionGroups.pGroup LEFT JOIN users on users.username=blog.user where
            ((permissions.action <> 'denyView' or permissions.action IS NULL) or (permissions.username <> '".$CURRENTUSER."'
            or permissions.username IS NULL)) and (permissionGroups.username='".$CURRENTUSER."') and (blog.threadID=$_REQUEST[ID]
            or blog.ID=$_REQUEST[ID]) order by date") or die(mysql_error());
         
         
         
        $comresult = mysql_query("SELECT COUNT(threadID) FROM blog WHERE threadID = " . $_REQUEST['ID'] );
        $comarray = mysql_fetch_row($comresult );
        $comment_count = $comarray[ 0 ];
        
		// this $cur is used to keep track of what is being printed; the first post printed in the main blog
		// post.  Any that follow are comments.  There is some special processing related to the original post that
		// does not apply to the comments.
		$cur = 1;
        // Display thread
        while ($row = mysql_fetch_array($parentBlog) )
        {
            drawMainTop();
            if( $cur == 1 )
			{
				if ($siteSettings['slickurls'] == TRUE )
					print("<h2><a href='" . $siteSettings['siteurl'] . "/blog/" . $row['ID'] . "'>" . $row['title'] . "</a></h2>");
				else
					print("<h2><a href='index.php?shard=" . $shard . "&amp;action=g_permaPost&amp;ID=" . $row['ID'] . "'>" . $row['title'] . "</a></h2>");
				$cur++;
			}
			else
				print("<h2>" . $row['title'] . "</h2>");
            date_line($row );
            
			// If you don't want the rel="nofollow" link attribute, change the function below to format_post
			// The $cur makes sure the first post is posted as usual (since you wrote it) while the ones that
			// follow are made to use the _nofollow functions
            if( $cur == 1 )
				$formatted = format_post($row['body'] , $row['user'] );
			else
				$formatted = format_post_nofollow($row['body'] , $row['user'] );
            $cur++;

            draw_pre_post();
            print($formatted );
            draw_post_post();
             
             
            if ($verifyEditDelete == true )
            {
                print("<small>");
                if ($siteSettings['slickurls'] == TRUE )
                {
                    print "<a href='" . $siteSettings['siteurl'] . "/index.php?shard=blog&amp;action=g_edit&amp;ID=" . $row['ID']. "'>Edit</a> |
                        <a href='" . $siteSettings['siteurl'] . "/index.php?shard=blog&amp;action=delete&amp;ID=" . $row['ID'] . "'>Delete</a> |";
                }
                else
                {
                    print "<a href='index.php?shard=blog&amp;action=g_edit&amp;ID=" . $row['ID']. "'>Edit</a> |
                        <a href='index.php?shard=blog&amp;action=delete&amp;ID=" . $row['ID'] . "'>Delete</a> |";
                }
                print("</small>");
            }
             
            drawMainBottom();
             
        }
         
         
         
         
    } // end if verified to view
    break;
     
     
     
     
     
     
     
     
     
     
     
     
     
     
    //-------------------------------------------------------------------------------------
    // g_reply - draw post with QuickQuote, show reply box
    //-------------------------------------------------------------------------------------
    case "g_reply":
     
    if (verify($CURRENTUSER, $_REQUEST['ID'], 'denyView'))
    {
        // Get all posts for this thread
        $parentBlog = mysql_query("SELECT blog.*, users.avatar FROM blog LEFT JOIN permissions ON permissions.objectID=blog.ID
            LEFT JOIN permissionGroups ON
            blog.permission = permissionGroups.pGroup LEFT JOIN users on users.username=blog.user where
            ((permissions.action <> 'denyView' or permissions.action IS NULL) or (permissions.username <> '".$CURRENTUSER."'
            or permissions.username IS NULL)) and (permissionGroups.username='".$CURRENTUSER."') and (blog.threadID=$_REQUEST[ID]
            or blog.ID=$_REQUEST[ID]) order by date") or die(mysql_error());
         
        $cur = 1; //used to format first post in regular way, without the rel='nofollow' attribute
         
        // Display thread
        while ($row = mysql_fetch_array($parentBlog) )
        {
            drawMainTop();
                         
            print("<h2>" . $row['title'] . "</h2>");
            date_line($row );
            
			
            // If you don't want the rel="nofollow" link attribute, change the function below to format_post
			// The $cur makes sure the first post is posted as usual (since you wrote it) while the ones that
			// follow are made to use the _nofollow functions
            if( $cur == 1 )
				$formatted = format_quickquote($row['body'] , $row['user'] );
			else
				$formatted = format_quickquote_nofollow($row['body'] , $row['user'] );
            $cur++;
			
             
            draw_pre_post();
            print($formatted );
            draw_post_post();
             
            if ($verifyEditDelete == true )
            {
                 
                print("<small>");
                if ($siteSettings['slickurls'] == TRUE )
                {
                    print "<a href='" . $siteSettings['siteurl'] . "/index.php?shard=blog&amp;action=g_edit&amp;ID=" . $row['ID']. "'>Edit</a> |
                        <a href='" . $siteSettings['siteurl'] . "/index.php?shard=blog&amp;action=delete&amp;ID=" . $row['ID'] . "'>Delete</a> |";
                }
                else
                {
                    print "<a href='index.php?shard=blog&amp;action=g_edit&amp;ID=" . $row['ID']. "'>Edit</a> |
                        <a href='index.php?shard=blog&amp;action=delete&amp;ID=" . $row['ID'] . "'>Delete</a> |";
                }
                print("</small>");
            }
             
             
            drawMainBottom();
             
        }
         
        //Resseting $row info
        mysql_data_seek($parentBlog, 0);
        $row = mysql_fetch_array($parentBlog);
         
        //Display reply form if verified to reply
        if (verify($CURRENTUSER, $_REQUEST['ID'], 'denyReply'))
        {
            drawMainTop();
             
            if ($siteSettings['slickurls'] == TRUE )
				$formaction = $siteSettings['siteurl'] . "/index.php?shard=blog&amp;action=proc_reply";
            else
                $formaction = 'index.php?shard=blog&amp;action=proc_reply';
             
            //draw_pre_post( );
            print("<a name='bottom'></a><small>Replying to post: </small><i>" . $row['title'] . "</i>" );
             
            print("
                <form name='replyForm' action=" . $formaction . " method='POST'>
                <small>Title:</small>
                <br />
                <input class='titleinput' value=\"RE: " . $row['title'] . "\" class='text' type='text' name='title' />
                <br />
                <small>Post Body:</small>
                <br />
                <textarea class='bodyinput' name='message' rows='20' cols='40'></textarea>
                 
                <br />
                <small>Click Submit to enter post</small>
                <br />
                <input type='hidden' name='ID' value=" . $row['ID'] . " />
                <input type='Submit' class='button' name='Submit' value='Submit' /></form>
                ");
            // draw_post_post();
             
            drawMainBottom();
        }
         
         
         
         
    } // end if verified to view
    break;
     
     
     
     
     
     
     
    //-------------------------------------------------------------------------------------
    // g_permaPost - view a specific post via its permanent link (permalink)
    //-------------------------------------------------------------------------------------
    case "g_permaPost":
     
    if (verify($CURRENTUSER, $_REQUEST['ID'], 'denyView'))
    {
        // Get all posts for this thread
        /*
        $parentBlog = mysql_query("SELECT blog.*, users.avatar FROM blog LEFT JOIN permissions ON permissions.objectID=blog.ID
        LEFT JOIN permissionGroups ON
        blog.permission = permissionGroups.pGroup LEFT JOIN users on users.username=blog.user where
        ((permissions.action <> 'denyView' or permissions.action IS NULL) or (permissions.username <> '".$CURRENTUSER."'
        or permissions.username IS NULL)) and (permissionGroups.username='".$CURRENTUSER."') and (blog.threadID=$_REQUEST[ID]
        or blog.ID=$_REQUEST[ID]) order by date") or die(mysql_error());
        */
        $entry = mysql_query("SELECT * FROM blog WHERE blog.ID=$_REQUEST[ID]") or die(mysql_error() );
         
         
        // Display thread
        while ($row = mysql_fetch_array($entry) )
        {
            $comresult = mysql_query("SELECT COUNT(threadID) FROM blog WHERE threadID = " . $row['ID'] );
            $comarray = mysql_fetch_row($comresult );
            $comment_count = $comarray[ 0 ];
             
            drawMainTop();
            print("<h2>" . $row['title'] . "</h2>");
            date_line($row );
            $formatted = format_post($row['body'] , $row['user'] );
            draw_pre_post();
            print($formatted );
            draw_post_post();
             
             
            blog_footer($row , $comment_count );
             
             
        }
         
         
    } // end if verified to view
    break;
    //-------------------------------------------------------------------------------------
    // proc_reply - process a reply to a blog post
    //-------------------------------------------------------------------------------------
    case "proc_reply":
    if (verify($CURRENTUSER, $_REQUEST["ID"], 'denyReply'))
    {
        $cleanmsg = htmlentities($_REQUEST['message'] );
         
        $inTime = time();
        $result = mysql_query("INSERT INTO blog
            (title, body, user, date, replyID, threadID, permission)
            VALUES
            ('$_REQUEST[title]', '$cleanmsg', '$CURRENTUSER', $inTime, $_REQUEST[ID], $_REQUEST[ID], 'everyone')")
        or DIE(mysql_error());
    }
     
    if ($siteSettings['slickurls'] == TRUE )
		header("Location: " . $siteSettings['siteurl'] . "/blog/" . $_REQUEST['ID'] . "/comments" );
    else
        header("Location: index.php?shard=blog&action=g_comments&ID=" . $_REQUEST['ID'] );
    
    break;
    //-------------------------------------------------------------------------------------
    // g_crt_new - create a new blog entry (show the form)
    //-------------------------------------------------------------------------------------
    case "g_crt_new":
     
     
    if (isInGroup($CURRENTUSER, "admin"))
    {
         
        $grpList = mysql_query("select pGroup from defineGroups order by ID") or die(mysql_error());
        drawMainTop();
         
        if ($siteSettings['slickurls'] == TRUE )
        $formaction = $siteSettings['siteurl'] . "/index.php?shard=blog&amp;action=proc_new";
        else
            $formaction = 'index.php?shard=blog&amp;action=proc_new';
         
         
        print("
            Create New Post<br /><br />
            <form action=" . $formaction . " method=POST>
             
             
            Title:
            <br />
            <input class='titleinput' type='text' name='title' />
            <br />
            Post Body:
            <br />
            <textarea class='bodyinput' name='body' rows='20' cols='40'></textarea>
            <br />
            <br />
            <small>This post will be visible to the following group</small>
             
            <select name='permission'> ");
        while ($row = mysql_fetch_array($grpList))
        {
            print('<option>' . $row['pGroup'] . '</option>');
        }
        print("</select>
            <br /><br />
            <small>Select a catagory for this content<br /></small>
            <select name='oldcat'>");
         
        $categories = mysql_query("SELECT DISTINCT category FROM blog") or die(mysql_error());
        while ($row = mysql_fetch_array($categories))
        {
            if ($row['category'] == '' )
				$category = 'Unfiled';
            else
                $category = $row['category'];
             
            print "<option>$category</option>";
        }
        print("</select> <small>or make a new one:</small> <input type='text' name='newcat' />
            <br /><br />
             
            <input type='Submit' class='button' name='Submit' value='Submit' /></form>");
         
         
        drawMainBottom();
    }
    break;
    //-------------------------------------------------------------------------------------
    // proc_new - process a new blog post (insert the blog)
    //-------------------------------------------------------------------------------------
    case "proc_new":
     
    $cleanmsg = htmlentities($_REQUEST['body'] );
    // if user specified a new category, let it be created
     
    $inTime = time();
     
    if ($_REQUEST['newcat'] != '' )
		$cat = $_REQUEST['newcat'];
    else // else use the category listed in the select box (one that already exists)
    {
        $cat = $_REQUEST['oldcat'];
        if ($cat == 'Unfiled' ) //let NULL mean unfiled; don't specifically set it to 'Unfiled', as it might later be called 'Uncategorized',eg
        $cat = '';
    }
     
    //
    // The code duplication here is ridiculouus.  The reason is for making category NULL; I tried to insert it
    // as NULL, 'NULL', and '' but it kept putting in those literal values.  I had to make a case that omits the
    // category value in the first case, then uses it in the second (when we don't want a NULL value).
    //
    if ($cat == '' )
    {
        $result = mysql_query("insert into blog
            (title, body, user, date, replyID, threadID, permission )
            VALUES
            ('$_REQUEST[title]', '$cleanmsg', '$CURRENTUSER', $inTime, 0, 0, '$_REQUEST[permission]')")
        or DIE(mysql_error() );
    }
    else
    {
        $result = mysql_query("insert into blog
            (title, body, user, date, replyID, threadID, permission, category)
            VALUES
            ('$_REQUEST[title]', '$cleanmsg', '$CURRENTUSER', $inTime, 0, 0, '$_REQUEST[permission]', '$cat')")
        or DIE(mysql_error() );
    }
     
     
    generate_blog_rss();
     
     
     
     
    if ($siteSettings['slickurls'] == TRUE )
		header("Location: " . $siteSettings['siteurl'] . "/blog");
    else
        header("Location: index.php?shard=blog");
     
     
    exit();
    break;
    //-------------------------------------------------------------------------------------
    // g_edit - edit the text of an already-created blog entry (show the form)
    //-------------------------------------------------------------------------------------
    case "g_edit":
     
    if (isInGroup($CURRENTUSER, "admin"))
    {
        $grpList = mysql_query("select pGroup from defineGroups order by ID") or die(mysql_error());
        $postData = mysql_query("select * from blog where ID=$_REQUEST[ID]") or DIE(mysql_error());
        $postData = mysql_fetch_array($postData);
        drawMainTop();
         
         
        if ($siteSettings['slickurls'] == TRUE )
        $formaction = $siteSettings['siteurl'] . "/index.php?shard=blog&amp;action=proc_edit";
        else
            $formaction = 'index.php?shard=blog&amp;action=proc_edit';
         
         
         
        print "
            EditPost<br />
            <form action=". $formaction . " method='POST'>
            <br />
            Title:
            <br />
            <input class='titleinput' type='text' name='title'  value=\"$postData[title]\" />
            <br />
            Post Body:
            <br />
            <textarea class='bodyinput' name='body' rows='20' cols='40'>$postData[body]</textarea>
            <br />
            Permission Group Visibility level:
            <br />
            <SELECT name='permission' />";
         
        while ($row = mysql_fetch_array($grpList))
        {
            print "<option";
            if ($row['pGroup'] == $postData['permission'])
            {
                print(" SELECTED VALUE=\"" . $row['pGroup'] . "\"");
            }
            print(">" . $row['pGroup'] . "</option>");
        }
        print "</select>
             
             
            Click Submit to submit edited post
            <br />
            <input type='hidden' name='ID' value='$_REQUEST[ID]' />
            <input type='Submit' class='button' name='Submit' value='Submit' /></form>";
         
         
        drawMainBottom();
    }
    break;
    //-------------------------------------------------------------------------------------
    // proc_edit - process the edited blog (submit into database)
    //-------------------------------------------------------------------------------------
    case "proc_edit":
     
    if (isInGroup($CURRENTUSER, "admin"))
    {
        $cleanmsg = htmlentities($_REQUEST['body'] );
         
        $result = mysql_query("update blog set permission='$_REQUEST[permission]', title='$_REQUEST[title]', body='$cleanmsg'
            where ID=$_REQUEST[ID]") or DIE(mysql_error());
         
         
         
         
        if ($siteSettings['slickurls'] == TRUE )
			header("Location: " . $siteSettings['siteurl'] . "/blog");
        else
            header("Location: index.php?shard=blog");
         
        exit();
    }
     
    break;
    //-------------------------------------------------------------------------------------
    // delete - delete a blog entry
    //-------------------------------------------------------------------------------------
    case "delete":
    if (isInGroup($CURRENTUSER, "admin"))
    {
        $result = mysql_query("delete from blog where ID=".$_REQUEST['ID'] ." OR replyID=" . $_REQUEST['ID'] );
         
        if ($siteSettings['slickurls'] == TRUE )
			header("Location: " . $siteSettings['siteurl'] . "/blog");
        else
            header("Location: index.php?shard=blog");
    }
    break;
    endswitch;
     
    
     
?>
