<?php
class Profile {

  private $db;

  public function __construct() {
    $this->db = new Db_layer();
  }

  public function get($column) {
    $sql=$this->db->query("SELECT $column FROM ".TABLE_USERS." WHERE id=".intval($_GET["profile"]));
    $sql=$this->db->fetch_array($sql);
    return $this->db->unescape($sql["$column"]);
  }
  
  public function stats($table) {
    $sql=$this->db->query("SELECT COUNT(*) AS c FROM $table WHERE author=".intval($_GET["profile"]));
    $sql=$this->db->fetch_array($sql);
    return $this->db->unescape($sql["c"]);
  }
  
  public function safe_address($data) {
    $data=str_replace("@", " (at) ", $data);
    return $data;
  }
  
  public function save_profile() {
    if (preg_match("/^[0-9a-zA-Z]{3,128}$/", $_POST["login"])) {

    if (!isset($_POST["delete_avatar"])) { $_POST["delete_avatar"]=""; }

    $about=htmlspecialchars($_POST["about"]);
    $about=str_replace("\r\n", "<br />", $about);

    $sql=$this->db->query("UPDATE ".TABLE_USERS." SET
    realname='".$this->db->escape(htmlspecialchars($_POST["realname"]))."',
    age='".$this->db->escape(htmlspecialchars($_POST["age"]))."',
    about='".$this->db->escape($about)."',
    mail='".$this->db->escape(htmlspecialchars($_POST["mail"]))."',
    jabber='".$this->db->escape(htmlspecialchars($_POST["jabber"]))."',
    skype='".$this->db->escape(htmlspecialchars($_POST["skype"]))."',
    msn='".$this->db->escape(htmlspecialchars($_POST["msn"]))."',
    mail_messages=".intval($_POST["mail_messages"])."
    WHERE id=".intval($_SESSION["user_id"]));

    if (TABLE_USERS=="kboard_users") {
    $sign=htmlspecialchars($_POST["sign"]);
    $sign=str_replace("\r\n", "<br />", $sign);

    $sql=$this->db->query("UPDATE ".TABLE_USERS." SET sign='".$this->db->escape($sign)."' WHERE id=".intval($_SESSION["user_id"]));
    }
    
    if ($_FILES["file"]["name"]!="") {
    
    $explode=explode(".", $_FILES["file"]["name"]);

    if ($explode[1]=="jpg" OR $explode[1]=="JPG") {
    $img_data=imagecreatefromjpeg($_FILES["file"]["tmp_name"]);
    }

    if ($explode[1]=="png" OR $explode[1]=="PNG") {
    $img_data=imagecreatefrompng($_FILES["file"]["tmp_name"]);
    }

    if ($explode[1]=="gif" OR $explode[1]=="GIF") {
    $img_data=imagecreatefromgif($_FILES["file"]["tmp_name"]);
    }
    
    $width=imagesx($img_data);
    $height=imagesy($img_data);
    if ($width>120) {
    $i=120/$width;
    $height=$i*$height;
    $width=120;
    }

    $create=imagecreatetruecolor($height, $height);
    imagecopyresampled($create, $img_data, 0, 0, 0, 0, $width, $height, imagesx($img_data), imagesy($img_data));

    if ($explode[1]=="jpg" OR $explode[1]=="JPG") {
    imagejpeg($create, "./avatars/".$_SESSION["user_id"].".".$explode[1], 100);
    }
    if ($explode[1]=="png" OR $explode[1]=="PNG") {
    imagepng($create, "./avatars/".$_SESSION["user_id"].".".$explode[1], 0);
    }
    if ($explode[1]=="gif" OR $explode[1]=="GIF") {
    imagegif($create, "./avatars/".$_SESSION["user_id"].".".$explode[1]);
    }
    
    $sql=$this->db->query("UPDATE ".TABLE_USERS." SET avatar='".$explode[1]."' WHERE id=".intval($_SESSION["user_id"]));
    
    imagedestroy($img_data);
  
    }

    $old=$this->db->query("SELECT login, password FROM ".TABLE_USERS." WHERE id=".intval($_SESSION["user_id"]));
    $old=$this->db->fetch_array($old);

    if ($old["login"]!=$_POST["login"]) {
    $check=$this->db->query("SELECT id FROM ".TABLE_USERS." WHERE login='".$this->db->escape($_POST["login"])."'");
    $check=$this->db->fetch_array($check);
    if ($check["id"]=="" AND preg_match("/^[0-9a-zA-Z]{3,128}$/", $_POST["login"])) {
    $sql=$this->db->query("UPDATE ".TABLE_USERS." SET login='".$this->db->escape(htmlspecialchars($_POST["login"]))."' WHERE id=".intval($_COOKIE["user_id"]));
    }
    }
    
    if ($_POST["delete_avatar"]==1) {
    $check=$this->db->query("SELECT avatar FROM ".TABLE_USERS." WHERE id=".$_SESSION["user_id"]);
    $check=$this->db->fetch_array($check);
    unlink("./avatars/".$_SESSION["user_id"].".".$check["avatar"]);
    $sql=$this->db->query("UPDATE ".TABLE_USERS." SET avatar='' WHERE id=".$_SESSION["user_id"]);
    }

    if ($_POST["new_password"]!="" AND SHA1($_POST["old_password"])==$old["password"]) {
    $sql=$this->db->query("UPDATE ".TABLE_USERS." SET password='".SHA1($_POST["new_password"])."' WHERE id=".$_SESSION["user_id"]);
    }

    header("Location: ./index.php?profile=".$_SESSION["user_id"]."&mt=1");

    } else { header("Location: ./index.php?profile=".$_SESSION["user_id"]."&mt=0"); }
  }

}
?>