Fix multiple appearances when ids are off

admin/index.php

@@ -8,11 +8,12 @@ $allok = 2;
 $txt=$_POST["txt"];
 $tim=$_POST["tim"];
 
-$txt = preg_replace("#((http|https|ftp)://(\S*?\.\S*?))(\s|\;|\)|\]|\[|\{|\}|,|\"|'|:|\<|$|\.\s)#ie", "'<a href=\"$1\" target=\"_blank\">http://$3</a>$4'", $txt);
+// Broken for some reason. 
+//$txt = preg_replace("#((http|https|ftp)://(\S*?\.\S*?))(\s|\;|\)|\]|\[|\{|\}|,|\"|'|:|\<|$|\.\s)#ie", "'<a href=\"$1\" target=\"_blank\">http://$3</a>$4'", $txt);
 
 $txt = Parsedown::instance()->parse($txt);
 
-if (isset($_FILES["file"])) {
+if (isset($_FILES["file"]) && $_FILES["file"]["name"]) {
 $allok = 0;
 
 $uploadLocation = "../" . UPLOAD_LOCATION . "";
@@ -34,20 +35,20 @@ die("File upload error");
 
 }
 
-if (isset($_POST["txt"]) && isset($_POST["tim"])) {
+if (isset($txt) && isset($tim)) {
 
 include "../connect.php";
 
 $mysql_table = MYSQL_TABLE;
-$qry = "INSERT INTO `$mysql_table` (`id`, `txt`, `tim`) VALUES (NULL, '".mysql_escape_string(nl2br($txt.$extrl))."', '".mysql_escape_string($tim)."')";
-$result = mysql_query($qry);
+$qry = "INSERT INTO `$mysql_table` (`id`, `txt`, `tim`) VALUES (NULL, '".mysqli_real_escape_string($db, nl2br($txt.$extrl))."', '".mysqli_real_escape_string($db, $tim)."')";
+$result = mysqli_query($db, $qry);
 
 if (!$result) {
-    die("Error! ".mysql_error());
+    die("Error! ".mysqli_error($db));
 } else {
 	$allok = 1;
 }
-mysql_close($link);
+mysqli_close($db);
 
 }
 ?>

admin/login.php

@@ -41,4 +41,4 @@ if ($sttype!=2) {
 	setcookie("adminlogin", json_encode($arr), time()+86400);
 	header("Location: index.php");
 }
-?>
+?>

config-sample.php

@@ -28,4 +28,4 @@ define('MBLOG_DESC', '
 
 define('MBLOG_PULLEY_TEXT', "What's this?");
 define('MBLOG_TOOLTIPS_TEXT', "Tap post to comment and like. :)");
-?>
+?>

connect.php

@@ -1,10 +1,6 @@
 <?php
-$link = mysql_connect(MYSQL_HOST, MYSQL_USERNAME, MYSQL_PASSWORD);
-if(!$link) {
-	die("Failed to connect to mysql server. ");
-}
-$db = mysql_select_db(MYSQL_DATABASE);
+$db = mysqli_connect(MYSQL_HOST, MYSQL_USERNAME, MYSQL_PASSWORD, MYSQL_DATABASE);
 if(!$db) {
-	die("Unable to select database. ");
+	die("Unable to connect to database. ");
 }
-?>
+?>

detail.php

@@ -5,11 +5,11 @@ include 'checklogin.php';
 include "connect.php";
 
 $mysql_table = MYSQL_TABLE;
-$qry="SELECT * FROM `$mysql_table` WHERE `id`='".mysql_escape_string($_GET["id"])."'";
-$result=mysql_query($qry);
+$qry="SELECT * FROM `$mysql_table` WHERE `id`='".mysqli_real_escape_string($db, $_GET["id"])."'";
+$result=mysqli_query($db, $qry);
 if($result) {
-    if(mysql_num_rows($result) == 1) {
-	    $row = mysql_fetch_array($result);
+    if(mysqli_num_rows($result) == 1) {
+	    $row = mysqli_fetch_array($result);
 ?>
 			<div class="t tp">
 			<?php
@@ -29,5 +29,5 @@ if($result) {
 <?php
 	}
 }
-mysql_close($link);
-?>
+mysqli_close($db);
+?>

get.php

@@ -5,15 +5,15 @@ include 'checklogin.php';
 include "connect.php";
 
 $mysql_table = MYSQL_TABLE;
-$qry="SELECT * FROM `$mysql_table` ORDER BY  `$mysql_table`.`id` ASC LIMIT ".mysql_escape_string($_GET["lastid"])." , 1000";
-$result=mysql_query($qry);
+$qry="SELECT * FROM `$mysql_table` WHERE `id`>".mysqli_real_escape_string($db, $_GET["lastid"])." ORDER BY `$mysql_table`.`id`";
+$result=mysqli_query($db, $qry);
 $newlastid=$_GET["lastid"];
 $jspo=array();
-while ($row = mysql_fetch_array($result)) {
-$newlastid=$newlastid+1;
+while ($row = mysqli_fetch_array($result)) {
+$newlastid=$row["id"];
 array_push($jspo, array("txt"=>stripslashes($row["txt"]), "tim"=>$row["tim"], "id"=>$row["id"]));
 }
 echo json_encode(array("posts"=>$jspo, "lastid"=>$newlastid));
 
-mysql_close($link);
-?>
+mysqli_close($db);
+?>

index.php

@@ -43,17 +43,18 @@ include 'checklogin.php';
 		include "connect.php";
 		$mysql_table = MYSQL_TABLE;
 		$qry="SELECT * FROM `$mysql_table` ORDER BY `$mysql_table`.`id` DESC LIMIT 0, 30 ";
-		$result=mysql_query($qry);
+		$result=mysqli_query($db, $qry);
 		$iffirst=0;
-		while ($row = mysql_fetch_array($result)) {
+		$newlastid="null";
+		while ($row = mysqli_fetch_array($result)) {
 			$postlinked = stripslashes($row["txt"]);
 			echo '<span class="post postid'.$row["id"].'"><div class="t"><span class="loadingh"></span>'.$postlinked.'</div><div class="i">'.$row["tim"].'</div></span>';
 			if ($iffirst==0) {
-				$newlastid=$row["id"]+1;
+				$newlastid=$row["id"];
 				$iffirst=1;
 			}
 		}
-		mysql_close($link);
+		mysqli_close($db);
 		?>
 		</div><!-- 
 		<br /><br /> -->
@@ -221,4 +222,4 @@ animationIn: 'bubble'
 </script>
 <script type="text/javascript" src="plugins/add2home.js" charset="utf-8"></script>
 </body>
-</html>
+</html>

initialize-tables.md

@@ -0,0 +1,11 @@
+
+Log in to your MySQL server, then run the following: 
+
+```
+CREATE TABLE microblog (
+id INT(6) UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+txt VARCHAR(320) NOT NULL,
+tim VARCHAR(40) NOT NULL,
+pluses INT(6) UNSIGNED DEFAULT 0
+)
+```

like.php

@@ -8,11 +8,11 @@ $stars=0;
 $starred="";
 
 $mysql_table = MYSQL_TABLE;
-$qrya="SELECT * FROM `$mysql_table` WHERE `id`='".mysql_escape_string($_GET["id"])."'";
-$resulta=mysql_query($qrya);
+$qrya="SELECT * FROM `$mysql_table` WHERE `id`='".mysqli_real_escape_string($db, $_GET["id"])."'";
+$resulta=mysqli_query($db, $qrya);
 if($resulta) {
-    if(mysql_num_rows($resulta) == 1) {
-	    $rowa = mysql_fetch_array($resulta);
+    if(mysqli_num_rows($resulta) == 1) {
+	    $rowa = mysqli_fetch_array($resulta);
 	    $stars=$rowa["pluses"];
 	}
 }
@@ -20,8 +20,8 @@ if($resulta) {
 $stars=$stars+1;
 
 if (isset($_GET["plusone"])) {
-	$qryb="UPDATE `$mysql_table` SET `pluses`='".($stars)."' WHERE `id`='".mysql_escape_string($_GET["id"])."'";
-	$resultb=mysql_query($qryb);
+	$qryb="UPDATE `$mysql_table` SET `pluses`='".($stars)."' WHERE `id`='".mysqli_real_escape_string($db, $_GET["id"])."'";
+	$resultb=mysqli_query($db, $qryb);
 	if($resultb) {
 		$starred="Thanks for a ★! ";
 	} else {
@@ -46,4 +46,4 @@ if (isset($_GET["plusone"])) {
 <?php echo $starred; ?><input type="submit" name="plusone" class="btn" value="+1 ★" /><span class="btnm"><?php echo $stars; ?></span>
 </form>
 </body>
-</html>
+</html>