Различные вопросы по PHP и MySQL

<?php

define('_IN_JOHNCMS', 1);
$textl = 'qidirish';
$headmod = 'usersearch';
require_once('incfiles/core.php');
require('incfiles/head.php');


echo '<div class="phdr" style="text-align: center"><b>Yangi do\'stlar topish</b></div>';
if (isset($_POST['submit']))
    {
$davlat = isset($_POST['davlat']) ? mb_substr(functions::checkin(trim($_POST['davlat'])), 0, 50) : null;
$shahar = isset($_POST['shahar']) ? mb_substr(functions::checkin(trim($_POST['shahar'])), 0, 50) : null;
$result = mysql_query("SELECT * FROM board_ads WHERE davlat LIKE '%$davlat%' AND shahar LIKE '%$shahar%'");

while ($row = mysql_fetch_array($result))
{
echo'<div class="menu">'.$row['name'].' - '.$row['time'].'</div>';
}

}else{


echo'<form action="qidir.php" method="post">';
echo'<p><h3>Давлат:</h3>' .
'<select name="davlat">' .
'<option value="uzb" >O`zbekiston</option>' .
'<option value="rus" >Rossiya</option>' .
'<option value="taj" >Tojikiston</option>' .
'<option value="kaz" >Qozog\'iston</option>' .
'<option value="qir" >Qirg\'iziston</option>' .
'</select></p>';
echo'<p>Шахар:</p>';
echo'<p><input type="text" name="shahar" value="Tashkent"></p>';
echo'<input type="submit" value="Qidirish" name="submit" /></form>';

}



require('incfiles/end.php');

<?php

if ($user_id)
{
    require_once ('incfiles/lib/class.upload.php');

    if ($id)
    {
        $object = $object->process_nav_panel($id);
        echo '<div class="phdr">' . $object->print_nav_panel() . '</div>';
    }
    else
    {
        echo '<div class="phdr"><a href="/">' . $lng['elon_doska'] . '</a>&nbsp;|&nbsp;' . $lng['elon_berish'] . '</div>';
    }

    if (isset($_POST['submit']))
    {

        $name = isset($_POST['name']) ? mb_substr(functions::checkin(trim($_POST['name'])), 0, 50) : null;
        $desc = isset($_POST['desc']) ? mb_substr(functions::checkin(trim($_POST['desc'])), 0, 1000) : null;
$davlat = isset($_POST['davlat']) ? mb_substr(functions::checkin(trim($_POST['davlat'])), 0, 50) : null;
$shahar = isset($_POST['shahar']) ? mb_substr(functions::checkin(trim($_POST['shahar'])), 0, 50) : null;

$narx2 = isset($_POST['narx']) ? mb_substr(abs(intval($_POST['narx'])), 0, 12) : 0;

$pul_birligi2 = isset($_POST['pul_birligi']) ? functions::check(trim($_POST['pul_birligi'])) : false;
$kelishilgan2 = isset($_POST['kelishilgan']) ? functions::check(trim($_POST['kelishilgan'])) : false;
$honalar2 = isset($_POST['honalar']) ? functions::check(trim($_POST['honalar'])) : false;
$yashashjoyi2 = isset($_POST['yashashjoyi']) ? mb_substr(functions::checkin(trim($_POST['yashashjoyi'])), 0, 50) : null;
$maydon2 = isset($_POST['maydon']) ? mb_substr(abs(intval($_POST['maydon'])), 0, 30) : 0;
$qavat2 = isset($_POST['qavat']) ? mb_substr(abs(intval($_POST['qavat'])), 0, 12) : 0;
$yash_tur = isset($_POST['yash_tur']) ? functions::check(trim($_POST['yash_tur'])) : false;

$number = isset($_POST['number']) ? mb_substr(abs(intval($_POST['number'])), 0, 12) : 0;
        $email = isset($_POST['email']) ? mb_substr(functions::checkin(trim($_POST['email'])), 0, 30) : null;
        $days = (isset($_POST['days'])) ? abs(intval($_POST['days'])) : 30;
        $end = time() + (3600 * 24 * $days);
        $status = ($set_board['moderation'] == 1) ? 0 : 1;

        $error = array();
        if (empty($name))
            $error[] = '' . $lng['elon_nomini_kiriting'] . '';
        if (empty($desc))
            $error[] = '' . $lng['elon_tafsinini_kiriting'] . '';
if (empty($davlat))
            $error[] = 'Давлат танланмади';
if (empty($shahar))
            $error[] = 'Шахар номида хатолик';
if (empty($narx2))
            $error[] = 'narx номида хатолик';
if (empty($pul_birligi2))
            $error[] = 'pul_birligi номида хатолик';
if (empty($kelishilgan2))
            $error[] = 'kelishilgan номида хатолик';
if (empty($honalar2))
            $error[] = 'honalar номида хатолик';
if (empty($yashashjoyi2))
            $error[] = 'yashashjoyi номида хатолик';
if (empty($maydon2))
            $error[] = 'maydon номида хатолик';
if (empty($qavat2))
            $error[] = 'qavat номида хатолик';
if (empty($yash_tur))
            $error[] = 'yash_tur номида хатолик';

        if ($days == 0 || $days < 0)
            $error[] = '' . $lng['elon_kuni'] . '';
        if ($set_board['pay'] == 1 && (($days - $set_board['free_days']) * $set_board['price']) > $datauser['balans'])
            $error[] = '' . $lng['hisobingizda_yetmaydi'] . '';

        if (!$error)
        {
            $handle = new upload($_FILES['img']);
            if ($handle->uploaded)
            {
                $fname = time();
                $handle->file_new_name_body = $fname;
                $handle->allowed = array (
                    'image/jpeg',
                    'image/jpg',
                    'image/gif',
                    'image/png'
                );
                $handle->file_max_size = 1024 * $set['flsz'];
                $handle->file_overwrite = true;
                $handle->image_resize = true;
                $handle->image_x = 175;
                $handle->image_y = 200;
                $handle->image_convert = 'png';
                $handle->process('files/board/');

                $handle->file_new_name_body = $fname;
                $handle->file_overwrite = true;
                $handle->image_resize = true;
                $handle->image_x = 75;
                $handle->image_y = 75;
                $handle->image_convert = 'png';
                $handle->process('files/board/small/');

                if ($handle->processed)
                {
                    mysql_query("INSERT INTO `board_ads` SET
                      `cat_id` = " . ($id ? $id : abs($_POST['cat_id'])) . ",
                      `user_id` = $user_id,
                      `img` = '1',
                      `name` = '" . mysql_real_escape_string($name) . "',
  `davlat` = '" . mysql_real_escape_string($davlat) . "',
  `shahar` = '" . mysql_real_escape_string($shahar) . "',
  `narx` = '" . mysql_real_escape_string($narx2) . "',
  `pul_birligi` = '" . $pul_birligi2 . "',
  `kelishilgan` = '" . $kelishilgan2 . "',
  `honalar` = '" . mysql_real_escape_string($honalar2) . "',
  `yashashjoyi` = '" . mysql_real_escape_string($yashashjoyi2) . "',
  `maydon` = '" . mysql_real_escape_string($maydon2) . "',
  `qavat` = '" . mysql_real_escape_string($qavat2) . "',
  `yash_tur` = '" . $yash_tur . "',
                      `desc` = '" . mysql_real_escape_string($desc) . "',
                      `number` = $number,
                      `email` = '" . mysql_real_escape_string($email) . "',
                      `end` = $end,
                      `time` = " . time() . ",
                      `status` = $status");

                    mysql_query("INSERT INTO `board_images` SET
                      `ad_id` = " . mysql_insert_id() . ",
                      `name` = '" . $fname . "'");
                }
                else
                {
                    echo functions::display_error($handle->error);
                }
                $handle->clean();
            }
            else
            {
                mysql_query("INSERT INTO `board_ads` SET
  `cat_id` = " . ($id ? $id : abs($_POST['cat_id'])) . ",
  `user_id` = $user_id,
  `name` = '" . mysql_real_escape_string($name) . "',
  `davlat` = '" . mysql_real_escape_string($davlat) . "',
  `shahar` = '" . mysql_real_escape_string($shahar) . "',
  `narx` = '" . mysql_real_escape_string($narx2) . "',
  `pul_birligi` = '" . $pul_birligi2 . "',
  `kelishilgan` = '" . $kelishilgan2 . "',
  `honalar` = '" . mysql_real_escape_string($honalar2) . "',
  `yashashjoyi` = '" . mysql_real_escape_string($yashashjoyi2) . "',
  `maydon` = '" . mysql_real_escape_string($maydon2) . "',
  `qavat` = '" . mysql_real_escape_string($qavat2) . "',
  `yash_tur` = '" . $yash_tur . "',
  `desc` = '" . mysql_real_escape_string($desc) . "',
  `number` = $number,
  `email` = '" . mysql_real_escape_string($email) . "',
  `end` = $end,
  `time` = " . time() . ",
  `status` = $status");
            }
            if ($set_board['pay'] == 1)
            {
                $price = ($days - $set_board['free_days']) * $set_board['price'];
                mysql_query("UPDATE `users` SET `balans` = `balans` - $price WHERE `id` = $user_id");
            }
            header('location: ?act=list&id=' . ($id ? $id : abs($_POST['cat_id'])));
        }
        else
        {
            echo functions::display_error($error, '<a href="' . $_SERVER['HTTP_REFERER'] . '">' . $lng['qaytarish'] . '</a>');
        }
    }
    else
    {

        echo '<div class="gmenu"><form action="?do=add_ad' . ($id ? '&amp;id=' . $id : null) . '" method="post" name="form" enctype="multipart/form-data">'
            . '<p>' . $lng['elon_nomi'] . '</p>'
            . '<input type="text" name="name">';
echo'<p><h3>Давлат: <span style="color:red;">*</span></h3>' .
'<select name="davlat">' .
'<option value="uzb" >O`zbekiston</option>' .
'<option value="rus" >Rossiya</option>' .
'<option value="taj" >Tojikiston</option>' .
'<option value="kaz" >Qozog\'iston</option>' .
'<option value="qir" >Qirg\'iziston</option>' .
'</select></p>';
echo'<p>Шахар: <span style="color:red;">*</span></p>';
echo'<p><input type="text" name="shahar" value="Tashkent"></p>';
?>
<div class="list1">
<label for="parameter-price">Нарх <span style="color:red;">*</span></label>
</div>

<p><input type="text" name="narx" value=""></p>
<p><select name="pul_birligi">
<option value="uzs" >сум</option>
<option value="uye" >у.е.</option>
</select></p>

<p><input type="checkbox" value="xa" name="kelishilgan">&nbsp;<span class="green"> Келишилган</span></p>

<p><h3>Хоналар сони:<span style="color:red;">*</span></h3></p>
<p><input type="text" name="honalar" value=""></p>

<p><h3>Яшаш майдони: </h3></p>
<p><input type="text" name="yashashjoyi" value=""> <span class="currency">м<sup>2</sup></span></p>

<p><h3>Умумий майдон: </h3></p>
<p><input type="text" name="maydon" value=""> <span class="currency">м<sup>2</sup></span></p>

<p><h3>Қават : </h3></p>
<p><input type="text" name="qavat" value=""></p>

<p><h3>Тур : </h3></p>
<p><select name="yash_tur">
<option value="">Танлаш</option>
<option value="0" >Ғишт рангли</option>
<option value="1" >Панельний</option>
<option value="2" >Монолит</option>
<option value="3" >Блокли</option>
<option value="4" >Тахтали</option>
</select></p>

<?
echo '<p>' . $lng['elon_tafsini'] . '<br>';
        echo bbcode::auto_bb('form', 'desc');
        echo '<textarea rows="' . $set_user['field_h'] . '" name="desc"></textarea></p>'
            . '<p>' . $lng['elon_nomer'] . '</p>'
            . '<input type="text" name="number">'
            . '<p>' . $lng['elon_email'] . '</p>'
            . '<input type="text" name="email">'
            . '<p>' . $lng['elon_rasm'] . '</p>'
            . '<input type="file" name="img">';
        if ($set_board['pay'] == 1)
        {
            echo '<p>' . $lng['elon_qancha_vaqt'] . ' ' . $set_board['price'] . ' ' . $lng['elon_ball_kun'] . ' ' . $set_board['free_days'] . ' ' . $lng['elon_bepul_kunlar'] . '</li></p>'
             . '<input type="text" size="2" name="days" value="' . $set_board['free_days'] . '">';
        }
        else
        {
            echo '<p><li>' . $lng['elon_30_kunga_tolov'] . '</li></p>';
        }
        if (!$id)
        {
            $req = mysql_query("SELECT `id`, `name` FROM `board_categories` WHERE `type` = 'ads'");
            if (mysql_num_rows($req))
            {
                echo '<p>' . $lng['elon_bolim'] . '<select name="cat_id">';
                while ($res = mysql_fetch_assoc($req))
                {
                    echo '<option value="' . $res['id'] . '">' . functions::checkout($res['name']) . '</option>';
                }
                echo '</select></p>';
            }
            else
            {
                echo '<p>' . $lng['elon_bolim_yoq'] . '</p>';
            }
        }
        echo '<p>' . $lng['elon_tekshiruv'] . ' ' . ($set_board['moderation'] == 0 ? '<span class="red">' . $lng['elon_ochirilgan'] . '</span>' : '<span class="green">' . $lng['elon_yoqilgan'] . '</span>') . '</p>'
            . '<p><input type="submit" name="submit" value="' . $lng['elon_qoshish'] . '"></p>'
            . '</form></div>';
    }
}
else
{
    header('location: ./');
}