CREATE TABLE `tutorials` (
`id` int(250) NOT NULL auto_increment,
`submitter` varchar(250) NOT NULL,
`text` text NOT NULL,
`short_description` text NOT NULL,
`title` varchar(250) NOT NULL,
`cat_id` int(25) NOT NULL,
`date_submitted` varchar(250) NOT NULL,
`time_submitted` varchar(250) NOT NULL,
`show_email` tinyint(1) NOT NULL,
`email` varchar(250) NOT NULL,
`views` int(250) NOT NULL default '0',
`is_validated` tinyint(1) NOT NULL,
PRIMARY KEY (`id`)
) ENGINE=MyISAM;

CREATE TABLE `tutorials_categorys` (
`id` int(25) NOT NULL auto_increment,
`category` varchar(250) NOT NULL,
`description` text NOT NULL,
PRIMARY KEY (`id`)
) ENGINE=MyISAM;

CREATE TABLE `tutorials_comments` (
`id` int(250) NOT NULL auto_increment,
`tut_id` int(250) NOT NULL,
`submitter` varchar(250) NOT NULL,
`text` text NOT NULL,
`time_submitted` varchar(250) NOT NULL,
PRIMARY KEY (`id`)
) ENGINE=MyISAM;

<?php
//------------------------------------------
//database connection
mysql_connect("localhost", "username", "password") or die(mysql_error());
mysql_select_db("database") or die(mysql_error());
//end database connection
//------------------------------------------

//------------------------------------------
//echo out a navigation panel
echo "
<center><a href='tutorials.php'>View Categorys</a> | <a href='tutorials.php?action=addtutorial'>Add Tutorial</a></center>
";
//------------------------------------------

//------------------------------------------
//begin main navigation (tutorials.php?action=)

switch($_GET['action'])
{
    //------------------------------------------
    //this case adds a tutorial.
    //pretty self-explanitory
    //------------------------------------------
    case "addtutorial":
    //if the form to enter a new
    //tutorial hasn't been submitted,
    //show it
    if(!isset($_POST['add_tutorial']))
    {
        echo "
        <table border='0' cellpadding='0' cellspacing='0' width='500'>
        <form action='$self?action=addtutorial' method='post'>
            <tr>
                <td>Name:</td>
                <td><input type='text' name='name'></td>
            </tr>
            <tr>
                <td>Title:</td>
                <td><input type='text' name='title'></td>
            </tr>
            <tr>
                <td>Category:</td>
                <td>
                    <select name='category'>
                        ";
                //now what we are doing here is looping through
                //the categorys table and getting all the
                //categorys and putting them into a select
                //so the user can select which category
                //the tutorial is on
                $query = mysql_query("SELECT * FROM tutorials_categorys ORDER BY id ASC") or die(mysql_error());
                while($row = mysql_fetch_array($query))
                {
                    echo "<option value='$row[id]'>$row[category]";
                }
                        echo "
                    </select>
                </td>
            </tr>
                <tr>
                <td>Tutorial:</td>
                <td><textarea name='tutorial' cols='40' rows='10'></textarea></td>
            </tr>
            </tr>
                <tr>
                <td>Short Description:</td>
                <td><textarea name='short_description' cols='40' rows='2'></textarea></td>
            </tr>
            <tr>
                <td>Email:</td>
                <td><input type='text' name='email' maxlength='50'></td>
            </tr>
            <tr>
                <td>Show Email?</td>
                <td><input type='checkbox' name='show_email' value='1' checked></td>
            </tr>
            <tr>
                <td colspan='2'><center><input type='submit' name='add_tutorial' value='Submit New Tutorial'></center></td>
            </tr>
        </form>
        </table>
        ";
    }
    //else, error check, enter it
    elseif(isset($_POST['add_tutorial']))
    {
        $name = mysql_real_escape_string(strip_tags($_POST['name']));
        $title = mysql_real_escape_string(strip_tags($_POST['title']));
        $category = mysql_real_escape_string(strip_tags($_POST['category']));
        $tutorial = mysql_real_escape_string(strip_tags($_POST['tutorial']));
        $short_description = mysql_real_escape_string(strip_tags($_POST['short_description']));
        $email = mysql_real_escape_string(strip_tags($_POST['email']));
        $show_email = mysql_real_escape_string($_POST['show_email']);
        $date = date("m/d/Y");
        $time = time();

        //we begin error checking....
        $error_msg = array();
        if(empty($name))
        {
            $error_msg[] = "Please insert a name!<br />";
        }
        if(empty($title))
        {
            $error_msg[] = "Please insert a title!<br />";
        }
        if(empty($category))
        {
            $error_msg[] = "Please insert a category!<br />";
        }
        if(empty($tutorial))
        {
            $error_msg[] = "Please insert the tutorial text!<br />";
        }
        if(empty($short_description))
        {
            $error_msg[] = "Please insert a short description!<br />";
        }
        if(empty($email))
        {
            $error_msg[] = "Please insert an email!<br />";
        }
        //print the errors, if any
        if(count($error_msg)>0)
        {
            echo "<strong>ERROR:</strong><br>n";
            foreach($error_msg as $err)
                echo "$err";
        }
        //everythings ok, insert it to the DB
        else
        {
            $sql = "INSERT INTO tutorials (submitter, text, short_description, title, cat_id, date_submitted, time_submitted, show_email, email, is_validated) VALUES ('$name', '$tutorial', '$short_description', '$title', '$category', '$date', '$time', '$show_email', '$email', '0')";
            mysql_query($sql) or die(mysql_error());
            echo "Tutorial added for review!";
        }
    }
    break;

    //------------------------------------------
    //this case gets the specified [ID] in the url
    //(tutorials.php?action=viewcategory&id=[ID]
    //and gets all the tutorials listed under that
    //category ID (cat_id)
    //------------------------------------------
    case "viewcategory":
    //if there is an ID given...
    if($_GET['id'])
    {
        //get the id, put it into a variable, cast to an INT
        //(for security purposes)
        $id = (int)$_GET['id'];
        $query = mysql_query("SELECT * FROM tutorials WHERE cat_id = '$id' AND is_validated = '1'") or die(mysql_error());

        //if no results, show that there are no tutorials
        //for that category
        if(mysql_num_rows($query) == 0)
        {
            echo "No tutorials for this category yet!";
        }
        //else, there is..show em
        else
        {
            echo "<h1>Tutorials</h1>";
            //loop through the tutorials
            //show all tutorials
            echo "<table border='0' cellpadding='0' cellspacing='0' width='500'>";
            while($row = mysql_fetch_array($query))
            {
                echo "
                    <tr>
                        <td>Title:</td>
                        <td><b>$row[title]</b></td>
                    </tr>
                    <tr>
                        <td>Date Submitted:</td>
                        <td><b>$row[date_submitted]</b></td>
                    </tr>
                    <tr>
                        <td>Views:</td>
                        <td>$row[views]</td>
                    </tr>
                    <tr>
                        <td>Short Description:</td>
                        <td>$row[short_description]</td>
                    </tr>
                    <tr>
                        <td>Submitter:</td>
                        <td>$row[submitter]</td>
                    </tr>
                    <tr>
                        <td colspan='2'><center><b><a href='$self?action=viewtutorial&id=$row[id]'>View</a></b></center></td>
                    </tr>
                    <tr>
                        <td colspan='2'><hr /></td>
                    </tr>
                ";
            }
            echo "</table>";
        }
    }
    else
    {
        echo "Please give me a category ID!";
    }
    break;

    //------------------------------------------
    //this case gets the given [ID]
    //action=viewtutorial&id=[ID]
    //and gets that tutorial ID from the database
    //and displays it!
    //------------------------------------------
    case "viewtutorial":
    //if there is an ID given..
    if($_GET['id'])
    {
        //set $id to the URL id, cast to an INT
        //for security purposes
        $id = (int)$_GET['id'];

        //query the database
        $query = mysql_query("SELECT * FROM tutorials WHERE id = '$id' LIMIT 1") or die (mysql_error());

        //if no rows returned...
        if(mysql_num_rows($query) == 0)
        {
            echo "That ID is not in the database!";
        }
        //else, show it!
        else
        {
            //update the views for this tutorial!
            $update_views = mysql_query("UPDATE tutorials SET views = views + 1 WHERE id = '$id'") or die(mysql_error());

            //loop through the database
            while($row = mysql_fetch_array($query))
            {
                echo "
                <table border='0' cellpadding='0' cellspacing='0' width='500' style='border: 1px solid black; padding: 3px;'>
                    <tr>
                        <td colspan='2'>Tutorial: <b>$row[title]</b></td>
                    </tr>
                    <tr>
                        <td colspan='2' style='border: 1px solid black;'><center><b>Tutorial</b></center><br />$row[text]</td>
                    </tr>
                    <tr>
                    ";
                    //----------------------------
                    //this part of the code
                    //checks to see if the submitter
                    //wants an email left for support
                    //----------------------------
                    if($row['show_email'] == 1)
                    {
                        echo "
                        <td colspan='2'>This tutorial was submitted by <b>$row[submitter]</b> with an email left for support questions. Contact this person <a href='mailto:$row[email]'>here</a></td>
                        ";
                    }
                    echo "
                    </tr>
                    <tr>
                        <td><hr /></td>
                    </tr>
                ";
            }
            //--------------------------------
            //this is where we loop through the
            //comments table to show all the
            //comments for this tutorial
            //--------------------------------
            $comments = mysql_query("SELECT * FROM tutorials_comments WHERE tut_id = '$id' ORDER BY id DESC") or die (mysql_error());

            //if there are no comments..
            if(mysql_num_rows($comments) == 0)
            {
                echo "
                    <tr>
                        <td colspan='2'>No comments for this tutorial yet!</td>
                    </tr>
                ";
            }
            //else, show them!
            else
            {
                //loop through them
                while($row = mysql_fetch_array($comments))
                {
                    echo "
                    <tr>
                        <td colspan='2'>Comment by: <b>$row[submitter]</b></td>
                    </tr>
                    <tr>
                        <td colspan='2'  style='border: 1px solid black; padding: 2px;' vAlign='top'>$row[text]</td>
                    </tr>
                    ";
                }
            }
            //show the form to enter comments
            echo "
            <tr>
                <td colspan='2'><hr /></td>
            </tr>
            <form action='$self' method='post'>
                <tr>
                    <td>Name:</td>
                    <td><input type='text' name='name' maxlength='25'></td>
                </tr>
                <tr>
                    <td>Comment:</td>
                    <td><textarea name='message' cols='40' rows='10'></textarea></td>
                </tr>
                <tr>
                    <td colspan='2'><center><input type='submit' name='add_comment' value='Add Comment'></center></td>
                </tr>
            </form>
            ";
            //-----------------------------
            //if the comment submit form
            //HAS been submitted, enter info
            //to the database.
            //-----------------------------
            if(isset($_POST['add_comment']))
            {
                //strip all HTML tags
                //and get rid of any quotes to prevent
                //SQL injection
                $message = mysql_real_escape_string(strip_tags($_POST['message']));
                $name = mysql_real_escape_string(strip_tags($_POST['name']));
                $time = time();

                //use an array to store all error messages
                $error_msg = array();
                if(empty($message))
                {
                    $error_msg[] = "Please enter a message!<br />";
                }
                if(empty($name))
                {
                    $error_msg[] = "Please enter a name!<br />";
                }
                //print the errors
                if(count($error_msg)>0)
                {
                    echo "<strong>ERROR:</strong><br>n";
                    foreach($error_msg as $err)
                        echo "$err";
                }
                //else, everything is ok, enter it in the DB
                else
                {
                    $query = mysql_query("INSERT INTO tutorials_comments VALUES (NULL,'$id','$name', '$message', '$time')") or die(mysql_error());
                }
            }
            echo "</table>";
        }
    }
    //if not..
    else
    {
        echo "No ID specified!";
    }
    break;

    //------------------------------------------
    //default case, this is shown default
    //in this instance, we are going to make the default case show
    //all the categories that you can view tutorials on
    //------------------------------------------
    default:
    $query = mysql_query("SELECT * FROM tutorials_categorys") or die(mysql_error());

    //if the number of rows returned is 0, then say, no categories
    if(mysql_num_rows($query) == 0)
    {
        echo "No tutorial categories currently!";
    }
    //if anything else, then there has to be categories. show em.
    else
    {
        echo "<h1>Tutorial Categories:</h1> ";
        //while loop to loop through the database and display results!
        while($row = mysql_fetch_array($query))
        {
            echo "
            <table border='0' cellpadding = '0' cellspacing='0' width='500'>
                <tr>
                    <td>Category Name:</td>
                    <td>$row[category]</td>
                </tr>
                <tr>
                    <td>Description:</td>
                    <td>$row[description]</td>
                </tr>
                <tr>
                    <td><a href='$self?action=viewcategory&id=$row[id]'>Visit this category</a></td>
                </tr>
                <tr>
                    <td><hr /></td>
                </tr>
            </table>
            ";
        }
    }
    break;
}
//end navigation
//------------------------------------------
?>

<?php
//------------------------------------------
//database connection
mysql_connect("localhost", "username", "password") or die(mysql_error());
mysql_select_db("database") or die(mysql_error());
//end database connection
//------------------------------------------


//------------[IMPORTANT]-------------------
// I would suggest adding this file to part
// of a user system so it doesn't get viewed
// by just anyone
//------------[IMPORTANT]-------------------


//------------------------------------------
//echo out a navigation panel
echo "
<center><a href="tutorials.php">View Categorys</a> | <a href="tutorials.php?action=addtutorial">Add Tutorial</a> | <a href="tutorials_admin.php">Admin</a> | <a href="tutorials_admin.php?action=addcategory">Add Category</a></center>
";
//------------------------------------------

//------------------------------------------
//begin main navigation (tutorials.php?action=)
switch($_GET['action'])
{
    //--------------------------
    // case to add a tutorial category
    //--------------------------
    case "addcategory":
    //if the form to add a new category
    //isn't submitted, show one
    if(!isset($_POST['new_category']))
    {
        echo "
        <form action='tutorials_admin.php?action=addcategory' method='post'>
        <table border='0' cellpadding='0' cellspacing='0' width='500'>
            <tr>
                <td>Category name:</td>
                <td><input type='text' name='category' maxlength='25'></td>
            </tr>
            <tr>
                <td>Description:</td>
                <td><textarea name='description' cols='40' rows='10'></textarea></td>
            </tr>
            <tr>
                <td colspan='2'><center><input type='submit' name='new_category' value='New Category!'></td>
            </tr>
        </table>
        </form>
        ";
    }
    //else, error check and then insert data to database!
    elseif(isset($_POST['new_category']))
    {
        $category = mysql_real_escape_string(strip_tags($_POST['category']));
        $description = mysql_real_escape_string(strip_tags($_POST['description']));

        //begin error reporting
        $error_msg = array();
        if(empty($category))
        {
            $error_msg[] = "No Category name entered!<br />";
        }
        if(empty($description))
        {
            $error_msg[] = "No description entered!<br />";
        }
        //print errors, if any
        if(count($error_msg)>0)
        {
            echo "<strong>ERROR:</strong><br>n";
            foreach($error_msg as $err)
                echo "$err";
        }
        //else, no errors, insert to the DB!
        else
        {
            $query = mysql_query("INSERT INTO tutorials_categorys (category, description) VALUES ('$category', '$description')") or die(mysql_error());
            echo "Tutorial Category Added!";
        }
    }
    break;

    //--------------------------
    //this case takes the submitted
    //form data of the admin form.
    //you can either validate, or delete
    //--------------------------
    case "handle":
    //if nothing is submitted in the
    //row[] array, then error!
    if(empty($_POST['row']))
    {
        echo "Nothing to delete/validate!";
    }
    if(isset($_POST['delete_tutorials']))
    {
        $delete_array = $_POST['row'];

        //loop through each individual
        //item in the array

        foreach($delete_array as $val)
        {
            //delete them!
            $query = "DELETE FROM tutorials WHERE id = '$val'";
            $result = mysql_query($query) or die(mysql_error());
        }
        echo "Tutorial(s) deleted";
    }
    elseif(isset($_POST['validate_tutorials']))
    {
        $validate_array = $_POST['row'];

        //loop through each individual
        //item in the array

        foreach($validate_array as $val)
        {
            //update the status to 1 which means validated!
            $query = "UPDATE tutorials SET is_validated = '1' WHERE id = '$val'";
            $result = mysql_query($query) or die(mysql_error());
        }
        echo "Tutorial(s) validated!";
    }
    break;

    //--------------------------
    //default case, we show
    //all tutorials with actions
    //--------------------------
    default:
    $query = mysql_query("SELECT * FROM tutorials WHERE is_validated = '0' ORDER BY time_submitted DESC") or die(mysql_error());
    echo "<h1>Unreviewed Tutorials</h1>";
    if(mysql_num_rows($query) == 0)
    {
        echo "No tutorials unreviewed!";
    }
    //there are rows, show the tutorials to
    //verify them
    else
    {
        //echo the submit buttons
        echo "
        <form action='tutorials_admin.php?action=handle' method='post'>
        <table border='0' cellpadding='0' cellspacing='0' width='500'>
            <tr>
                <td><center>With Selected</center></td>
            </tr>
            <tr>
                <td colspan='2'><center><input type='submit' name='validate_tutorials' value='Validate'><input type='submit' name='delete_tutorials' value='Delete'></center></td>
            </tr>
            <tr>
                <td colspan='2'><hr /></td>
            </tr>
        ";
        //loop throught it to show them all
        while($row = mysql_fetch_array($query))
        {
            echo "
            <tr>
                <td>Title:</td>
                <td>$row[title]</td>
            </tr>
            <tr>
                <td>Submitter:</td>
                <td>$row[submitter]</td>
            </tr>
            <tr>
                <td>Short Description:</td>
                <td>$row[short_description]</td>
            </tr>
            <tr>
                <td>Tutorial Text:</td>
                <td>$row[text]</td>
            </tr>
            <tr>