wops.waiswuaschd.de/administration.php

<?php 
#Datenbank Verbindung einbinden
 require 'Connections/Connections.php'; 
#Include datei für Loginüberprüfung
include "Includes/Session.php";
#Abbruch wenn nicht berechtigt
if($Userlvl < 3 ){
header('Location: Bestellen.php');
exit;}

#Funktion um User in Dropdown aufzulisten
function get_user_list()
{
	global $con; # setzt die Variable CON für die Datenbank verbindung
	#Prüfen ob Bearbeiten gedrückt wurde
	if(!isset($_POST['bearbeiten'])){
		#Notwendige Daten aus Datenbank lesen	
		$lesen= $con->query("SELECT UserID,Fname,Lname,isactive,ordered FROM user order by UserID ASC");
		#Dropdown zusammenbauen
		echo "<td><select class='CField' name='User'>";
		echo '<option value="0">Bitte wählen</option>';
		while($row = mysqli_fetch_array($lesen))
		{
			#Prüfen ob aktiv oder passiv gesetzt und anzeigen
			if($row['isactive'] == 0){ $STATUS=" (disabled)"; }else{$STATUS=" (activ)";}
			echo "<option value =".$row['UserID'].">".$row['Lname']."$STATUS</option>";
		}
		echo "</select>";
		echo "<input class=\"button\" type=\"submit\" name=\"bearbeiten\" value=\"bearbeiten\"/></form></td></tr></table></div>";
	}else{
		#Funktion edit_user aufrufen
		edit_user();	
	}
}

#Funtkion für User bearbeitung
function edit_user()
{
	if ($_POST['User'] == 0 ){
		print "<script type='text/javascript' langeuage='javascript'>
		    alert('Kein User ausgewählt!');window.location = 'Userverwaltung.php';</script>";
	}else{
	global $con;
	#Userid setzen
	$userID = $_POST['User'];
	#Daten des Users laden
	$result= $con->query("SELECT * FROM user where UserID = $userID");
	#Tabelle aus array des Users füllen
	while($user = mysqli_fetch_array($result))
	{
	echo '
	<td><input name="U_UserID" type="hidden" required="required" class="TFi" value='.$user["UserID"].'><p>'.$user["UserID"].'</p></td>
	<td><input name="U_Fname" type="text" required="required" class="" value='.$user["Fname"].'></td>
	<td><input name="U_Lname" type="text" required="required" class="" value='.$user["Lname"].'></td>
	<td><input name="U_Email" type="text" required="required" class="" value='.$user["Email"].'></td>
	<td><input name="U_isactive" type="text" required="required" class="" value='.$user["isactive"].'></td>
	<td><input name="U_Username" type="text" class="" value='.$user["Username"].'></td>
	<td><input name="U_Password" type="password"  class="" ></td>
	<td><input name="U_UserLevel" type="text" required="required" class="" value='.$user["UserLevel"].'></td>
	<td><input name="U_Ordered" type="text" required="required" class="" value='.$user["ordered"].'></td>';
	}
	echo '</tr></table></div>
			<input name="Update" type="submit" class="button" value="Update Info"/>
			<input name="Delete" type="submit" class="button" value="Account Löschen"/>
	</form>';
	}
}
#Funktion user settings speichern
function update()
{
	global $con;
	$U_UserID = $_POST['U_UserID'];
	$U_Fname = $_POST['U_Fname'];
	$U_Lname = $_POST['U_Lname'];
	$U_Email = $_POST['U_Email'];
	$U_isactive = $_POST['U_isactive'];
	$U_Username = $_POST['U_Username'];
	$U_Password = $_POST['U_Password'];
	$U_UserLevel = $_POST['U_UserLevel'];
	$U_Ordered = $_POST['U_Ordered'];
	#Prüfen ob password eingegeben wurde oder nicht leer ist
	if(isset($U_Password) AND !empty($U_Password)){
		#Wenn password eingegeben wurde password und andere Daten speichern
		$Update_Password = password_hash("$U_Password", PASSWORD_BCRYPT, array('cost' => 10));
		$sql = $con->query("UPDATE user SET Fname='{$U_Fname}', Lname='{$U_Lname}', Email='{$U_Email}', isactive='{$U_isactive}', Username='{$U_Username}', Password='{$Update_Password}', UserLevel='{$U_UserLevel}', ordered='{$U_Ordered}' where UserID= $U_UserID");
	#Sonst nur ändere werte ändern
	}else{
		$sql = $con->query("UPDATE user SET Fname='{$U_Fname}', Lname='{$U_Lname}', Email='{$U_Email}', isactive='{$U_isactive}', Username='{$U_Username}', UserLevel='{$U_UserLevel}', ordered='{$U_Ordered}' where UserID= $U_UserID");
	}
}

function remove_account()
{
	global $con;
	$U_UserID = $_POST['U_UserID'];
	$result = $con->query("delete from user WHERE UserID='{$U_UserID}';") or die(mysql_error());
	}

#Button Überprüfen und Funktion auffrufen
if(isset($_POST['Update'])){
update();
}

if(isset($_POST['Delete'])){
remove_account();
}

if(isset($_POST['Datenschutz'])){
 $con->query("update user set privacy_policy = 0");
}

#Header und menü einbinden
$webpagetitle = "Userverwaltung";
include "Includes/Header.php";
include "Includes/Menu.php";
#html Content ausgeben
?>
		<div class="content">
		<div class="Rahmen">
		<form action="" method="POST" name="Administration">
		<div class="table-container">
		<table class="U_T_User">
			<tr>
			<td>UserID</td>
			<td>Vorname</td>
			<td>Nachname</td>
			<td>E-Mail</td>
			<td>isactive</td>
			<td>Username</td>
			<td>Password</td>
			<td>UserLevel</td>
			<td>Bestellt</td>
			</tr>
			<tr>
			<?php  get_user_list(); #User list ausgeben?>
			<br/>
			<hr />
			<div class="center">
				<h1>Neue Datenschutzerklärung</h1>
				<form action="" method="POST" name="Datenschutz">
				<input class="button" type="submit" name="Datenschutz" value="speichern"/></form>
				</form>
			<div>

		</div>
		</div>
		
<?php 
#Footer einbinden
include "Includes/Footer.php";
?>