<?php
require_once('include/config.php');
session_start();

header('Content-Type: text/html; charset=utf-8');

// 1. 检查管理员登录状态
if(!isset($_SESSION['admin_name'])){
   header("location:admin_login.php");
   exit;
}

// 2. 处理 POST 请求（回复留言）
if(isset($_GET['act']) && $_GET['act']=='reply')
{   
   // 简单的安全处理：确保 ID 是数字
   $id = intval($_GET['id']);
   
   // 获取 POST 数据并转义，防止 SQL 注入或报错
   $content = mysqli_real_escape_string($db, $_POST['content']);
   $username = mysqli_real_escape_string($db, $_POST['username']);
   $reply = mysqli_real_escape_string($db, $_POST['reply']);
   $img = mysqli_real_escape_string($db, $_POST['img']);
   $ip = mysqli_real_escape_string($db, $_POST['ip']);
   $posttime = mysqli_real_escape_string($db, $_POST['posttime']);
   $user_img = mysqli_real_escape_string($db, $_POST['user_img']);
   $dream = mysqli_real_escape_string($db, $_POST['dream']);
   $verify = mysqli_real_escape_string($db, $_POST['verify']);

   // 拼接 SQL
   $sql = "update book set 
           content='$content',
           username='$username',
           img='$img',
           ip='$ip',
           posttime='$posttime',
           user_img='$user_img',
           dream='$dream',
           verify='$verify',
           reply='$reply',
           replytime='".date("Y-m-d H:i:s")."' 
           where id=$id";
           
   // 执行更新 (修复：加上 $db)
   $result = mysqli_query($db, $sql);
   
   if ($result) {
       die("<script>window.alert('留言回复成功！');window.location.href='index.php';</script>");
   } else {
       die("<script>alert('回复失败：" . mysqli_error($db) . "');history.back();</script>");
   }
}

// 3. 处理 GET 请求（删除留言）
if(isset($_GET['act']) && $_GET['act']=='del')
{
  $id = intval($_GET['id']); // 确保是数字
  $sql = "delete from book where id=$id";
  
  // 执行删除 (修复：加上 $db)
  $result = mysqli_query($db, $sql);
  
  if ($result) {
      die("<script>window.alert('留言删除成功！');window.document.location.href='index.php';</script>");
  } else {
      die("<script>alert('删除失败：" . mysqli_error($db) . "');history.back();</script>");
  }
}
?>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="target-densitydpi=device-dpi, width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.5, user-scalable=no">
<title><?php echo webname.version ?></title>
<link rel="stylesheet" type="text/css" href="include/main.css" />
<!--留言正文框高度自适应-->
<script type="text/javascript">
var observe;
if (window.attachEvent) {
    observe = function (element, event, handler) {
        element.attachEvent('on'+event, handler);
    };
}
else {
    observe = function (element, event, handler) {
        element.addEventListener(event, handler, false);
    };
}
function init () {
    var content = document.getElementById('content');
    function resize () {
        content.style.height = 'auto';
        content.style.height = content.scrollHeight+'px';
    }
    /* 0-timeout to get the already changed content */
    function delayedResize () {
        window.setTimeout(resize, 0);
    }
    observe(content, 'cut',     delayedResize);
    observe(content, 'paste',   delayedResize);
    observe(content, 'drop',    delayedResize);
    observe(content, 'keydown', delayedResize);
    resize();
}
</script>
</head>
<body onload="init();">
<?php require_once('head.php');?>
<br>
<?php
  // 4. 查询当前留言信息（修复：加上 $db）
  $id = intval($_GET['id']);
  $showsql = "select * from book where id=$id";
  $row = mysqli_query($db, $showsql);
  
  if ($row) {
      $rs = mysqli_fetch_array($row);
  } else {
      die("获取留言信息失败：" . mysqli_error($db));
  }
?>
<div class="huifu_k">
<div class="huifu_user"><font color="#999">回复 </font><?php echo $rs['username'];?>：<?php echo $rs['content'];?></div>
<table width="100%" border="0" align="center" cellpadding="0" cellspacing="0">
<form action="?act=reply&id=<?php echo $_GET['id'];?>" method="post" name="message">
  <tr>
    <td height="20" align="center"></td>
  </tr>
  <tr>
    <td align="center"><label>
      <textarea name="reply" rows="6" class="input" id="reply"><?php echo $rs['reply'];?></textarea>
    </label></td>
    </tr>
  <tr>
    <td height="80" align="right"><label>
        <input name="Submit" type="submit" class="botton" value="回 复" />
    </label></td>
  </tr>
  <tr>
    <td class="biaoti">留言正文</td>
  </tr>
  <tr>
    <td><textarea name="content" rows="5" class="huifu_zw" id="content"><?php echo htmlspecialchars($rs['content']);?></textarea></td>
  </tr>
  <tr>
    <td class="biaoti">名字</td>
  </tr>
  <tr>
    <td><input name="username" value="<?php echo $rs['username'];?>" type="text" class="huifu_qita" id="textfield8"></td>
  </tr>
  <tr>
    <td class="biaoti">ID</td>
  </tr>
  <tr>
    <td><input name="id" value="<?php echo $rs['id'];?>"  type="text" class="huifu_qita" id="textfield"></td>
  </tr>
  <tr>
    <td class="biaoti">图片地址</td>
  </tr>
  <tr>
    <td><input name="img" value="<?php echo $rs['img'];?>" type="text" class="huifu_qita" id="textfield2"></td>
  </tr>
  <tr>
    <td class="biaoti">IP地址</td>
  </tr>
  <tr>
    <td><input name="ip"  value="<?php echo $rs['ip'];?>" type="text" class="huifu_qita" id="textfield3"></td>
  </tr>
  <tr>
    <td class="biaoti">发布时间</td>
  </tr>
  <tr>
    <td><input name="posttime" value="<?php echo $rs['posttime'];?>" type="text" class="huifu_qita" id="textfield4"></td>
  </tr>
  <tr>
	<td class="biaoti">回复时间</td>
  </tr>
  <tr>
    <td><input name="replytime" value="<?php echo $rs['replytime'];?>" type="text" class="huifu_qita" id="textfield7"></td>
  </tr>
  <tr>
    <td class="biaoti">头像</td>
  </tr>
  <tr>
    <td><input name="user_img" value="<?php echo htmlspecialchars($rs['user_img']);?>" type="text" class="huifu_qita" id="textfield5"></td>
  </tr>
  <tr>
    <td class="biaoti">来源</td>
  </tr>
  <tr>
    <td><input name="dream" value="<?php echo htmlspecialchars($rs['dream']);?>" type="text" class="huifu_qita" id="textfield6"></td>
  </tr>
  <tr>
    <td class="biaoti">认证</td>
  </tr>
  <tr>
    <td><input name="verify" value="<?php echo htmlspecialchars($rs['verify']);?>" type="text" class="huifu_qita" id="textfield9"></td>
  </tr>
  </form>
</table>
</div>
<div>
  <p>
    <?php 
require_once('foot.php');
?>
</p>
  <p>&nbsp;  </p>
</div>
</body>
</html>