Current Project (looking for feedback)

Been working on a ticketing website for a club at my college called Tech Team. Basically we fix computers for people pretty cheap to fund our growing supply of tools and hardware. I made this so we can keep track of all of our current repairs and so the people we are fixing them for can also check on them.

Link:
http://techteam.dyndns.biz/

User/Pass:
test/test


Haven't put it into use yet, I wanted to get some feedback from this community first. If you find some type of security flaw (hopefully I safeguarded enough) please pm it to me, and don't try to screw up my hard work :thumbup1:. The design is not final either, I just felt like I needed something to look at while I was working on it.


Looking for feedback on functionality, not the design. I know the design sucks, and I do plan on fixing it, it's just not my specialty.

index.php

Spoiler:

PHP Code:

---

<?php
session_start();

include 'site.functions.php';

site::dbconnect();

include 'site.session.php';
include 'site.design.php';
include 'site.manage.php';
include 'site.constant.php';
include 'site.tickets.php';
jscript::header();

$page = $_GET['page'];
$option = $_GET['option'];
$option2 = $_GET['option2'];
$tid = $_GET['tid'];
$uid = $_GET['uid'];
$sessuid = $_SESSION['uid'];
$sessuser = $_SESSION['username'];

design::page($page);

if ($control == "logout")
{
    session_destroy();
}
if ($page == "repair")
{
    if(LOGGED_IN)
    {    
        if($option == "create")
        {
            if(isset($_POST['createticket']))
            {
            tickets::createticket();
            }
            else
            {
            tickets::ticketform();
            }
        
        }
        elseif($option == "check")
        {
            if($option2 == "selected")
            {
                tickets::checkticket($tid, "tickets");
            }
            else
            {
                tickets::checkticket(0, "tickets");
            }
        }
        elseif($option == "edit")
        {
            if($option2 == "submit")
            {
                tickets::submitedit($tid);
            }
            else
            {
                tickets::editticket($tid);    
            }
        }
        elseif($option == "archive")
        {
            if($option2 == "selected")
            {
                tickets::checkticket($tid, "archive");
            }
            elseif($option2 == "delete")
            {
                tickets::deleteticket($tid);    
            }
            elseif($option2 == "move")
            {
                tickets::moveticket($tid, "archive");    
            }
            elseif($option2 == "restore")
            {
                tickets::moveticket($tid, "tickets");
            }
            else
            {
                tickets::checkticket(0, "archive");
            }                
        }
        else
        {
            tickets::checkticket(0, "tickets");
        }
    }
    else
    {
        echo "<font color=red>You must be logged in to view this page</font>";
        sessionhand::loginform();    
    }    
}
elseif($page == "register")
{

    if(isset($_POST['register']))
    {
        sessionhand::register();
    }
    else
    {
        sessionhand::registerform("","","","","");
    }
}
elseif($page == "home")
{
    design::homepage();
}
elseif($page == "portal")
{
    if(LOGGED_IN)
        {    
        if($option == "timeclock")
        {
            echo "This page is currently under construction.";
        }
        elseif($option == "manage")
        {
            if(AUTH_3)
            {
                if($option2 == "selected")
                {
                    admin::level3($uid, "selected");
                }
                elseif($option2 == "submitedit")
                {
                    admin::level3($uid, "submitedit");
                }
                elseif($option2 == "deleteuser")
                {
                    admin::level3($uid, "deleteuser");
                }
                else
                {
                    admin::manage();
                }
            }
            else
            {
                echo "<font color=red>You are not authorized to view this page.</font>";
            }
        }
        elseif($option == "logout")
        {
            sessionhand::logout();
        }
        else
        {
            sessionhand::userbox();
        }
    }
    else
    {
        sessionhand::userbox();
    }
    
}
elseif($page == "ticket")
{
    if($option == "check")
    {
        if($tid > 0)
        {
            tickets::checkticket($tid, "tickets");    
        }
    }    
}
elseif($page == "forgotpw")
{
    if(isset($_POST['forgotpw']))
    {
        sessionhand::forgotpw();
    }
    else
    {
        sessionhand::forgotpwform("","","","");
    }
}
else
{
    design::homepage();
}
design::endpage();
?>

---

site.tickets.php

Spoiler:

PHP Code:

---

<?php
class tickets
{
    function ticketform()
    {
        if(AUTH_2)
        {
            $next = tickets::nextticket();
            echo "Next ticket number: ".$next;

            
            echo "<form action=\"index.php?page=repair&option=create\" method=\"post\">
                <input type=\"hidden\" name=\"createticket\">
                <table>
                <tr><td>First Name:</td><td><input type=\"text\" name=\"fname\"></td></tr>
                <tr><td>Last Name:</td><td><input type=\"text\" name=\"lname\"></td></tr>    
                <tr><td>Phone #:</td><td><input type=\"text\" name=\"phone\"></td></tr>
                <tr><td>Email:</td><td><input type=\"text\" name=\"email\"></td></tr>        
                <tr><td>Computer Brand:</td><td><input type=\"text\" name=\"brand\"></td></tr>
                <tr><td>Serial #:</td><td><input type=\"text\" name=\"serial\"></td></tr>
                <tr><td>Backup:</td><td><input type=\"checkbox\" name=\"backup\" value=\"1\"></td></tr>
                <tr><td>Virus Removal:</td><td><input type=\"checkbox\" name=\"virus\" value=\"1\"></td></tr>
                <tr><td>Re-install:</td><td><input type=\"checkbox\" name=\"install\" value=\"1\"></td></tr>
                <tr><td>Comments:</td><td></td></tr>
                <tr><td colspan=2><textarea name=\"comments\" cols=50 rows=10></textarea></td></tr>
                <tr><td colspan=2 align=center><input type=\"hidden\" name=\"tid\" value=\"".$next."\"><input type=\"submit\" value=\"Submit\" name=\"createticket\"></form></td></tr>
                </table>";    
        }    
        else
        {
        echo "You do not have the required authority to view this page.";    
        }    
    }
    function createticket()
    {
        if(AUTH_2)
        {
            $tid        = preg_replace("/[^0-9]/","", $_POST['tid']);
            $brand        = preg_replace("/[^A-Za-z0-9]/","", $_POST['brand']);
            $serial        = preg_replace("/[^A-Za-z0-9]/","", $_POST['serial']);
            $fname        = preg_replace("/[^A-Za-z0-9]/","", $_POST['fname']);
            $lname        = preg_replace("/[^A-Za-z0-9]/","", $_POST['lname']);
            $phone1        = preg_replace("/[^0-9]/","", $_POST['phone']);
            $serial        = preg_replace("/[^A-Za-z0-9]/","", $_POST['serial']);
            $backup        = preg_replace("/[^0-9]/","", $_POST['backup']);
            $virus        = preg_replace("/[^0-9]/","", $_POST['virus']);
            $install    = preg_replace("/[^0-9]/","", $_POST['install']);
            $comments    = mysql_real_escape_string($_POST['comments']);                
            $email        = $_POST['email'];
            
            if (filter_var($email, FILTER_VALIDATE_EMAIL)  != TRUE) 
            {
                $email = preg_replace("/[^A-Za-z0-9]/", "", $email);
            }

                $query = "INSERT INTO tickets (brand,serial,virus,reimage,backup,comments,statvirus,statreimage,statbackup,pickup,Fname,Lname,email,phone) VALUES ('".$brand."','".$serial."','".$virus."','".$install."','".$backup."','".$comments."','".$statvirus."','".$statreimage."','".$statbackup."','".$pickup."','".$fname."','".$lname."','".$email."','".$phone1."')";
                $run = mysql_query($query);
                if(!$run)
                {
                    echo "Something went wrong while trying to create your repair 
                            ticket, please try again.";
                }
                else
                {
                    echo "The ticket has been successfully created.";
                    tickets::checkticket($tid, "tickets");
                }
        }
    }
    function checkticket($data,$data2)
    {
        $sessuser = $_SESSION["username"];    

            if($data == 0)
            {

                $query = "SELECT * FROM ".$data2." ORDER BY TID ASC";
                $run = mysql_query($query);
                $foundnum = mysql_num_rows($run);
                if($foundnum==0)
                {
                    if($data2 == "tickets")
                    {
                        echo "There are currently no open repair tickets.";
                    }
                    elseif($data2 == "archive")
                    {
                        echo "There are currently no archived tickets.";
                    }
                }
                else
                {
                    echo "<table>";                    
                    while($row = mysql_fetch_assoc($run))
                    {
                        $brand    = $row['brand'];
                        $tid     = $row['TID'];
                        $fname    = $row['Fname'];
                        $lname    = $row['Lname'];
                                if($data2 == "tickets")
                                {
                                    echo "<tr><td align=left><a href=\"index.php?page=repair&option=check&option2=selected&tid=".$tid."\">".$tid." - ".$brand." - ".$fname." ".$lname."</a></td></tr>";                                    
                                }
                                elseif($data2 == "archive")
                                {
                                    echo "<tr><td align=left><a href=\"index.php?page=repair&option=archive&option2=selected&tid=".$tid."\">".$tid." - ".$brand." - ".$fname." ".$lname."</a></td></tr>";    
                                }


                    }
                    echo "</table>";                    
                }
            }
            else
            {
                $tid = preg_replace("/[^0-9]/","", $data);
                $query = mysql_query("SELECT * FROM ".$data2." WHERE TID =".$tid);    
                $foundnum = mysql_num_rows($query);            
                if($foundnum==0)
                {
                    echo "That support ticket does not exist.";
                }
                else
                {
                    $result = mysql_fetch_assoc($query);
                    $brand = $result['brand'];
                    $serial = $result['serial'];
                    $virus = $result['virus'];
                    $reimage = $result['reimage'];
                    $backup = $result['backup'];
                    $comments = $result['comments'];
                    $statvirus = $result['statvirus'];
                    $statreimage = $result['statreimage'];
                    $statbackup = $result['statbackup'];
                    $pickup = $result['pickup'];
                    $fname = $result['Fname'];
                    $lname = $result['Lname'];
                    $email = $result['email'];
                    $phone = $result['phone'];
                    $phone = site::formatPhone($phone);
                    $comments = site::mynl2br($comments);
                    
                    if($virus == 1)
                    {
                        $virus = "<font color=green>Yes</font>";
                        if($statvirus == 1)
                        {
                            $statvirus = "<font color=green>Complete</font>";
                        }
                        else
                        {
                            $statvirus = "<font color=red>Pending</font>";
                        }
                    }
                    else
                    {
                        $virus = "<font color=red>No</font>";
                        $statvirus = "";
                    }
                    if($backup == 1)
                    {
                        $backup = "<font color=green>Yes</font>";
                        if($statbackup == 1)
                        {
                            $statbackup = "<font color=green>Complete</font>";
                        }
                        else
                        {
                            $statbackup = "<font color=red>Pending</font>";
                        }
                    }
                    else
                    {
                        $backup = "<font color=red>No</font>";
                        $statbackup = "";
                    }    
                    if($reimage == 1)
                    {
                        $reimage = "<font color=green>Yes</font>";
                        if($statreimage == 1)
                        {
                            $statreimage = "<font color=green>Complete</font>";
                        }
                        else
                        {
                            $statreimage = "<font color=red>Pending</font>";
                        }
                    }
                    else
                    {
                        $reimage = "<font color=red>No</font>";
                        $statreimage = "";
                    }
                    if($pickup == 1)
                    {
                        $pickup = "<font color=green>Yes</font>";
                    }
                    else
                    {
                        $pickup = "<font color=red>No</font>";
                    }
                    if($data2 == "archive")
                    {
                        echo "You must have Javascript enabled in order to delete tickets.";
                    }
                    else
                    {
                        echo "<br />";
                    }
                    echo "<table>
                        <tr><td><b>Ticket #:</b></td><td colspan=2>".$tid."</td></tr>
                        <tr><td><b>Ready for Pickup:</b></td><td colspan=2>".$pickup."</td></tr>
                        <tr><td><b>Name:</b></td><td colspan=2>".$fname." ".$lname."</td></tr>
                        <tr><td><b>Phone #:</b></td><td colspan=2>".$phone."</td></tr>
                        <tr><td><b>Email:</b></td><td colspan=2>".$email."</td></tr>
                        <tr><td><b>Brand:</b></td><td colspan=2>".$brand."</td></tr>
                        <tr><td><b>Serial #:</b></td><td colspan=2>".$serial."</td></tr>
                        <tr><td><b>Virus<br/>Removal:</b></td><td>".$virus."</td><td>".$statvirus."</td></tr>
                        <tr><td><b>Data<br>Recovery:</b></td><td>".$backup."</td><td>".$statbackup."</td></tr>
                        <tr><td><b>Reimage<br/>if necessary:</b></td><td>".$reimage."</td><td>".$statreimage."</td></tr>
                        <tr><td colspan=3><br/></td></tr>
                        <tr><td colspan=3><b>Comments:</b></td></tr>
                        <tr><td colspan=3>".$comments."</td></tr>
                        <tr><td colspan=3><hr></td></tr>";                    
                    
                        if(AUTH_1)
                        {
                            if($data2 == "tickets")
                            {
                            echo "<tr><td align=\"center\"><form action=\"index.php?page=repair&option=edit&tid=".$tid."\" method=\"post\">
                                    <input type=\"submit\" value=\"Edit\"></form></td>";
                                if(AUTH_2)
                                {        
                                echo "<td align=\"center\"><form name=\"archiveticketform\" action=\"index.php?page=repair&option=archive&option2=move&tid=".$tid."\" method=\"post\">
                                        <input type=\"button\" onclick=\"return ticketArchive()\" value=\"Archive\"></form></td>";    
                                }
                                else
                                {
                                    echo "<td></td>";
                                }
                                
                            echo "</tr>";
                            
                            }
                            elseif($data2 == "archive")
                            {
                                if(AUTH_2)
                                {
                                    echo "<tr>
                                        <td align=\"center\"><form name=\"deleteticketform\" method=\"POST\" action=\"index.php?page=repair&option=archive&option2=delete&tid=".$tid."\">
                                        <input type=\"button\" onclick=\"return ticketDelete()\" value=\"Delete\"></form></td>";
                                    
                                        
                                    echo "<td align=\"center\"><form action=\"index.php?page=repair&option=archive&option2=restore&tid=".$tid."\" method=\"post\">
                                        <input type=\"submit\" value=\"Un-Archive\"></form></td></tr>";
                                }
                            }
                        }
                    }
                        
                        $query = mysql_query("SELECT * FROM updates WHERE TID = ".$tid." ORDER BY TUID ASC");
                        $foundnum = mysql_num_rows($query);
        
                        if($foundnum > 0)
                        {    
                            echo "<tr><td><br /><b>Update Notes:</b></td></tr>";
                            while($row = mysql_fetch_assoc($query))
                            {
                                $comment    = $row['Comment'];
                                $comment     = site::mynl2br($comment);
                                $time        = $row['time'];
                                echo "<tr><td colspan=3><hr></td></tr>
                                    <tr><td colspan=3><i>".$time."</i></td></tr>
                                        <tr><td colspan=3>".$comment."</td></tr>";
                            }
                            echo "</table>";
                        }
                        else
                        {
                            echo "</table>";
                        }                            
                }
    }
    function editticket($data)
    {
        $tid = preg_replace("/[^0-9]/","", $data);
        $run = mysql_query("SELECT * FROM tickets WHERE TID =".$tid);
        $result = mysql_fetch_assoc($run);
        
        $brand = $result['brand'];
        $serial = $result['serial'];
        $virus = $result['virus'];
        $reimage = $result['reimage'];
        $backup = $result['backup'];
        $comments = $result['comments'];
        $comments = site::mynl2br($comments);
        $statvirus = $result['statvirus'];
        $statreimage = $result['statreimage'];
        $statbackup = $result['statbackup'];
        $pickup = $result['pickup'];
        $fname = $result['Fname'];
        $lname = $result['Lname'];
        $email = $result['email'];
        $phone = $result['phone'];
        
        $date = date('M d\, Y g\:i a');

        if($pickup == 1)
        {
            $pickup = "<input type=\"checkbox\" checked=\"checked\" name=\"pickup\" value=\"1\">";
        }
        else
        {
            $pickup = "<input type=\"checkbox\" name=\"pickup\" value=\"1\">";
        }
        
        if($virus == 1)
        {
            $virus = "<font color=green>Yes</font>";
            if($statvirus == 1)
            {
                $statvirus = "<input type=\"checkbox\" checked=\"checked\" name=\"statvirus\" value=\"1\">";
            }
            else
            {
                $statvirus = "<input type=\"checkbox\" name=\"statvirus\" value=\"1\">";
            }
        }
        else
        {
            $virus = "<font color=red>No</font>";
            $statvirus = "<input type=\"checkbox\" disabled=\"true\">";
        }
        
        if($backup == 1)
        {
            $backup = "<font color=green>Yes</font>";
            if($statbackup == 1)
            {
                $statbackup = "<input type=\"checkbox\" checked=\"checked\" name=\"statbackup\" value=\"1\">";
            }
            else
            {
                $statbackup = "<input type=\"checkbox\" name=\"statbackup\" value=\"1\">";
            }
        }
        else
        {
            $backup = "<font color=red>No</font>";
            $statbackup = "<input type=\"checkbox\" disabled=\"true\">";
        }    
        
        if($reimage == 1)
        {
            $reimage = "<font color=green>Yes</font>";
            if($statreimage == 1)
            {
                $statreimage = "<input type=\"checkbox\" checked=\"checked\" name=\"statreimage\" value=\"1\">";
            }
            else
            {
                $statreimage = "<input type=\"checkbox\" name=\"statreimage\" value=\"1\">";
            }
        }
        else
        {
            $reimage = "<font color=red>No</font>";
            $statreimage = "<input type=\"checkbox\" disabled=\"true\">";
        }
        
        if(AUTH_1)
        {
            echo "<form action = \"index.php?page=repair&option=edit&option2=submit&tid=".$tid."\" method=\"post\">
                    <table>
                    <tr><td><b>Ticket #:</b></td><td colspan=2>".$tid."</td></tr>
                    <tr><td><b>Ready for Pickup:</b></td><td colspan=2>".$pickup."</td></tr>
                    <tr><td><b>Name:</b></td><td colspan=2>".$fname." ".$lname."</td></tr>
                    <tr><td><b>Phone #:</b></td><td colspan=2>".$phone."</td></tr>
                    <tr><td><b>Email:</b></td><td colspan=2>".$email."</td></tr>
                    <tr><td><b>Brand:</b></td><td colspan=2>".$brand."</td></tr>
                    <tr><td><b>Serial #:</b></td><td colspan=2>".$serial."</td></tr>
                    <tr><td><b>Virus<br/>Removal:</b></td><td>".$virus."</td><td>".$statvirus."</td></tr>
                    <tr><td><b>Data<br>Recovery:</b></td><td>".$backup."</td><td>".$statbackup."</td></tr>
                    <tr><td><b>Reimage<br/>if necessary:</b></td><td>".$reimage."</td><td>".$statreimage."</td></tr>
                    <tr><td colspan=3><b>Comments:</b></td></tr>
                    <tr><td colspan=3>".$comments."</td></tr>
                    <tr><td colspan=3><hr></td></td>
                    <tr><td colspan=3><b>Update Entry:</b></td></tr>
                    <tr><td colspan=3><textarea name=\"updatecomments\" cols=50 rows=10></textarea></td></tr>
                    </table>
                    <input type=\"hidden\" value=\"".$tid."\" name=\"tid\">                                                                                                    
                    <input type=\"hidden\" value=\"".$date."\" name=\"time\">
                    <input type=\"submit\" value=\"Submit\"></form>
                    ";    
                    
        }
    }
    function submitedit($tid)
    {
        $tid                = $_POST['tid'];
        $tid                = preg_replace("/[^0-9]/", "", $tid);
        $pickup                = $_POST['pickup'];
        $pickup                = preg_replace("/[^0-9]/", "", $pickup);
        $statvirus            = $_POST['statvirus'];
        $statvirus            = preg_replace("/[^0-9]/", "", $statvirus);
        $statbackup            = $_POST['statbackup'];
        $statbackup            = preg_replace("/[^0-9]/", "", $statbackup);
        $statreimage        = $_POST['statreimage'];
        $statreimage        = preg_replace("/[^0-9]/", "", $statreimage);
        $updatecomments        = $_POST['updatecomments'];
        $updatecomments        = mysql_real_escape_string($updatecomments);
        $time                = $_POST['time'];
        $time                = mysql_real_escape_string($time);
        
        $query = mysql_query("UPDATE tickets SET pickup = '".$pickup."', statvirus = '".$statvirus."', statbackup = '".$statbackup."', statreimage = '".$statreimage."' WHERE tid = ".$tid);
        if(!$query)
        {
            echo "An error occurred while trying to update the ticket, try refreshing the page or logging out and back in.";
        }
        else
        {
            if(strlen($updatecomments) < 5)
            {
                tickets::checkticket($tid, "tickets");
            }
            else
            {
                $query = mysql_query("INSERT INTO updates (TID, comment, time) VALUES ('".$tid."','".$updatecomments."','".$time."')");
                if(!$query)
                {
                    echo "An error occurred while trying to update the ticket, try refreshing the page or logging out and back in.";    
                }
                else
                {
                    tickets::checkticket($tid, "tickets");
                }
            }
        }
        
    }
    function moveticket($data, $data2)
    {
        if($data2 == "tickets")
        {
            $switch = "archive";    
        }
        elseif($data2 == "archive")
        {
            $switch = "tickets";
        }
        $query    = mysql_query("SELECT * FROM ".$switch." WHERE TID = ".$data);
        if(!$query)
        {
            echo "An error occurred while trying to archive this ticket, please refresh or relog and try again.";
        }
        else
        {
            $result    = mysql_fetch_assoc($query);
            
            $brand            = $result['brand'];
            $serial            = $result['serial'];
            $virus            = $result['virus'];
            $reimage        = $result['reimage'];
            $backup            = $result['backup'];
            $comments        = $result['comments'];
            $comments        = mysql_real_escape_string($comments);
            $statvirus         = $result['statvirus'];
            $statreimage     = $result['statreimage'];
            $statbackup     = $result['statbackup'];
            $pickup         = $result['pickup'];
            $fname             = $result['Fname'];
            $lname             = $result['Lname'];
            $email            = $result['email'];
            $phone             = $result['phone'];
            
            $query = mysql_query("INSERT INTO ".$data2." (TID,brand,serial,virus,reimage,backup,comments,statvirus,statreimage,statbackup,pickup,Fname,Lname,email,phone) VALUE ('".$data."','".$brand."','".$serial."','".$virus."','".$reimage."','".$backup."','".$comments."','".$statvirus."','".$statreimage."','".$statbackup."','".$pickup."','".$fname."','".$lname."','".$email."','".$phone."')");
            if(!$query)
            {
            echo "An error occurred while trying to archive this ticket, please refresh or relog and try again.";
            }
            else
            {
                $query = mysql_query("DELETE FROM ".$switch." WHERE TID = ".$data);
                if(!$query)
                {
                    echo "An error occurred while trying to archive this ticket, please refresh or relog and try again.";                    
                }
                else
                {
                    tickets::checkticket($data, $data2);    
                }
            }
        }    
    }
    function deleteticket($data)
    {
        if(AUTH_2)
        {
            $query = mysql_query("DELETE FROM archive WHERE TID = ".$data);
            if(!$query)
            {
                echo "An error occurred while trying to delete this ticket, please refresh or relog and try again.";            
            }
            else
            {
                $query = mysql_query("DELETE FROM updates WHERE TID = ".$data);
                if(!$query)
                {
                echo "An error occurred while trying to delete this ticket, please refresh or relog and try again.";                
                }
                else
                {
                    tickets::checkticket(0, "tickets");
                }
            }    
        }
    }
    function nextticket()
    {
            $result = mysql_query("SHOW TABLE STATUS LIKE 'tickets'");
            $row = mysql_fetch_array($result);
            $next = $row['Auto_increment'];
            $next = sprintf("%04d", $next);
            return $next;
    }    
}
?>

---

site.session.php

Spoiler:

PHP Code:

---

<?php
class sessionhand
{
    function loginform()
    {
        echo "<form name=\"login\" action=\"index.php?page=portal\" method=\"post\"> 
        <input type=\"hidden\" name=\"login\" />
        Username:<br /><input type=\"text\" name=\"username\" maxlength=\"10\"/><br />
        Password:<br /><input type=\"password\" name=\"password\" maxlength=\"15\"/><br /><br />
        <input type=\"submit\" value=\"Login\" />
        </form><a href=\"index.php?page=register\">Register</a> | <a href=\"index.php?page=forgotpw\">Forgot Password</a>";    
    }
    function login($username,$password)
    {    
        if($username != "" && $password != "" )
        {
          if(ctype_alnum($username) && ctype_alnum($password))
          {
            $password = site::encryptpassword($password);
            $query = "SELECT * FROM users WHERE ID = '".$username."'";
            $run = mysql_query($query);     
            $result= mysql_fetch_assoc($run);
            $pwd = $result['PWD'];
            $uid = $result['UID'];
            $fname = $result['Fname'];
            $auth = $result['AUTH'];

                if ($password == $pwd)    
                {
                    $_SESSION["uid"] = $uid;
                    $_SESSION["username"] = $username;
                    $_SESSION["fname"] = $fname;
                    $_SESSION["auth"] = $auth;
                    
                    if(isset($_SESSION["username"]))
                    {
                        sessionhand::handle();
                    }
                    else
                    {
                        sessionhand::handle();
                    }
                    
                }
                else
                {
                    echo "<font color=red>login failed</font><br />";
                    sessionhand::loginform();
                }
            }
            else
            {
                echo "<font color=red>login failed</font><br />";
                sessionhand::loginform();
            }
        }
        else
        {
            echo "<font color=red>login failed</font><br />";
            sessionhand::loginform();
        }
    }
    function logout()
    {
        session_destroy();
        sessionhand::loginform();
    }
    function userbox()
    {
        if (isset($_POST['login']))
        {
            $username = $_POST['username'];
            $password = $_POST['password'];

                if($username == "" || $password == "" || !ctype_alnum($username) || !ctype_alnum($password))
                {
                    echo "<font color=red>login failed</font><br />";
                    sessionhand::loginform();
                }
                else
                {
                sessionhand::login($username,$password);
                }
        }        
        elseif(LOGGED_IN) 
        {
            $uid = $_SESSION['uid'];
            $uid = preg_replace("/[^0-9]/","", $uid);    
                if (isset($_POST['logout']))
                {
                    sessionhand::logout();
                }
                else
                {
                    sessionhand::handle();
                }
        }
        else
        {
            sessionhand::handle();
        }
    }
    function handle()
    {
        if(isset($_SESSION["username"])) 
        {
            $uid = $_SESSION['uid'];
        
            //echo "<br />";
            echo "<font size=\"3\">Hello ".$_SESSION['fname']."</font><br />";
            echo "<br />";

            echo "<form name=\"logout\" action=\"index.php?page=portal\" method=\"post\">
            <input type=\"hidden\" name=\"logout\" />
            <input type=\"submit\" value=\"Logout\" /></form>";
            echo "<br />";
        
        }
        else
        {
        sessionhand::loginform();
        }
    }
    function register()
    {
        $settings    = parse_ini_file('settings.ini');
        $secret        = $settings['secret'];
        
        $username    = $_POST['username'];
        $password    = $_POST['password'];
        $password1    = $_POST['password1'];
        $fname        = $_POST['fname'];
        $lname        = $_POST['lname'];
        $email        = $_POST['email'];
        $access        = $_POST['access'];
        $sid        = $_POST['sid'];
        if($sid == "")
        {
            $sid = "0";
        }
        
        if(!ctype_alnum($fname) || !ctype_alnum($lname) || !ctype_alnum($sid))
        {
            echo "<font color=red>There were invalid characters in the information you entered.</font>";
            sessionhand::registerform($username,$fname,$lname,$email,$sid);
        }
        else
        {
    
            if(!ctype_alnum($username) || !ctype_alnum($password) || !ctype_alnum($password1)) 
            {
                echo "<font color=red>There were invalid characters in the username or password you entered.</font>";
                sessionhand::registerform($username,$fname,$lname,$email,$sid);
            }
            else
            {
                if($password != $password1) 
                {
                    echo "<font color=red>The password(s) you entered do not match.</font>";
                    sessionhand::registerform($username,$fname,$lname,$email,$sid);
                }
                else
                {
                    if($access != $secret)
                    {
                        echo "<font color=red>The access code you entered was not valid.</font>";
                        sessionhand::registerform($username,$fname,$lname,$email,$sid);
                    }
                    else
                    {
                        if(filter_var($email, FILTER_VALIDATE_EMAIL)  == TRUE) 
                        {
                            $query = "SELECT ID FROM users WHERE ID = '".$username."'";
                            $run = mysql_query($query);     
                            
                            if(!$run)
                            {
                                echo "<font color=red>Something went wrong.</font>";    
                            }
                            else
                            {
                                $foundnum = mysql_num_rows($run);
                                
                                if ($foundnum==0)
                                {
                                    $password = site::encryptpassword($password);    
                                    $sql = "INSERT INTO users (ID,PWD,Fname,Lname,Email,AUTH,SID) VALUES ('".$username."','".$password."','".$fname."','".$lname."','".$email."','1','".$sid."')";
                                    
                                    $result = mysql_query($sql);
                                    if(!$result) 
                                    {
                                        echo "<font color=red>An error occurred, please reload the page and try again.</font>";
                                    } 
                                    else 
                                    {
                                        echo "<font color=green>You have successfully registered.</font><br />";
                                        sessionhand::userbox();
                                    }
                                }
                                else
                                {
                                    echo "<font color=red>The username you entered has already been used.</font>";
                                    sessionhand::registerform("",$fname,$lname,$email,$sid);
                                }    
                            }
                        }
                        else
                        {
                            echo "<font color=red>There were invalid characters in the email address you entered.</font>";
                            sessionhand::registerform($username,$fname,$lname,"",$sid);
                        }
                    }
                }
            }
        }
    }
    function registerform($id,$fname,$lname,$email,$sid)
    {
        echo "<br />Registration is for Tech Team members only.<br />";
        echo "<form name=\"register\" action=\"index.php?page=register\" method=\"post\"> 
                    <input type=\"hidden\" name=\"register\" />
                    Username:<br /><input type=\"text\" name=\"username\" maxlength=\"10\" value=\"".$id."\"/><br />
                    Password:<br /><input type=\"password\" name=\"password\" maxlength=\"15\" /><br />
                    Re-enter Password:<br /><input type=\"password\" name=\"password1\" maxlength=\"15\" /><br />
                    Access Code:<br /><input type=\"password\" name=\"access\" maxlength=\"10\" /><br /><br />
                    First Name:<br /><input type=\"text\" name=\"fname\" maxlength=\"15\" value=\"".$fname."\" /><br />
                    Last Name:<br /><input type=\"text\" name=\"lname\" maxlength=\"15\" value=\"".$lname."\" /><br />
                    Email:<br /><input type=\"text\" name=\"email\" maxlength=\"35\" value=\"".$email."\" /><br />
                    Student ID Number:<br /><input type=\"text\" name=\"sid\" maxlength=\"10\" value=\"".$sid."\" /><br />
                    <input type=\"submit\" value=\"Register\" />
                    </form><br />";
    }
    function verifyuser($sessuser)
    {
        if(ctype_alnum($sessuser))
        {
            $query = mysql_query("SELECT * FROM users WHERE ID = '".$sessuser."'");
            $run = mysql_fetch_array($query); 
            return (isset($run["ID"]));
        }
        else
        {
            return false;
        }
    }
    function verifyauth($sessuser, $variable)
    {
        if(ctype_alnum($sessuser))
        {
            $query = mysql_query("SELECT AUTH FROM users WHERE ID = '".$sessuser."'");
            $run = mysql_fetch_assoc($query);

            if($run["AUTH"] >= $variable)
            {
                return true;
            }
            else
            {
                return false;
            }
        }
        else
        {
            return false;
        }
    }
    function forgotpwform($username,$first,$last,$email)
    {
        echo "<form name=\"forgotpw\" action=\"index.php?page=forgotpw\" method=\"post\"> 
                    <input type=\"hidden\" name=\"forgotpw\" />
                    Username:<br /><input type=\"text\" name=\"username\" maxlength=\"10\" value=\"".$username."\"/><br />
                    New Password:<br /><input type=\"password\" name=\"password\" maxlength=\"15\" /><br />
                    Re-enter Password:<br /><input type=\"password\" name=\"password1\" maxlength=\"15\" /><br />
                    Access Code:<br /><input type=\"password\" name=\"access\" maxlength=\"10\" /><br /><br />
                    First Name:<br /><input type=\"text\" name=\"fname\" maxlength=\"15\" value=\"".$first."\"/><br />
                    Last Name:<br /><input type=\"text\" name=\"lname\" maxlength=\"15\" value=\"".$last."\"/><br />
                    Email:<br /><input type=\"text\" name=\"email\" maxlength=\"35\" value=\"".$email."\"/><br />
                    Student ID Number:<br /><input type=\"password\" name=\"sid\" maxlength=\"10\" /><br />
                    <input type=\"submit\" value=\"Submit\" />
                    </form><br />";        
    }
    function forgotpw()
    {
        $settings    = parse_ini_file('settings.ini');
        $secret        = $settings['secret'];
        
        $username    = $_POST['username'];
        $password    = $_POST['password'];
        $password1    = $_POST['password1'];
        $fname        = $_POST['fname'];
        $lname        = $_POST['lname'];
        $email        = $_POST['email'];
        $sid        = $_POST['sid'];
        $access        = $_POST['access'];
        if($sid == "")
        {
            $sid = "0";
        }
        if(!ctype_alnum($fname) || !ctype_alnum($lname) || !ctype_alnum($sid) ||
        !ctype_alnum($username) || !ctype_alnum($password) || !ctype_alnum($password1))
        {
            echo "<font color=red>Failed to change password.</font><br />";
            sessionhand::forgotpwform($username,$fname,$lname,$email);
        }
        else
        {
            if($password == $password1 && filter_var($email, FILTER_VALIDATE_EMAIL)  == TRUE)  
            {
                if($secret == $access)
                {
                    $query = "SELECT * FROM users WHERE ID = '".$username."'";
                    $run = mysql_query($query);
                    $foundnum = mysql_num_rows($run);
                    if($foundnum==1)
                    {
                        $result= mysql_fetch_assoc($run);
                        $id = $result['ID'];
                        $email1 = $result['Email'];
                        $fname1 = $result['Fname'];
                        $lname1 = $result['Lname'];
                        $auth = $result['AUTH'];
                        $sid1 = $result['SID'];
                        if($username == $id && $fname == $fname1 && $lname == $lname1 && $email == $email1 && $sid == $sid1)
                        {
                            $password = site::encryptpassword($password);
                            $query = mysql_query("UPDATE users SET PWD = '".$password."' WHERE ID = '".$id."'");
                            if(!$query)
                            {
                                echo "<font color=red>Failed to change password.</font><br />";
                                sessionhand::forgotpwform($username,$fname,$lname,$email);
                            }
                            else
                            {
                                echo "<font color=green>Password successfully changed.</font><br />";
                                sessionhand::loginform();
                            }
                        }
                        else
                        {
                            echo "<font color=red>Failed to change password.</font><br />";
                            sessionhand::forgotpwform($username,$fname,$lname,$email);
                        }
                    }
                    else
                    {
                        echo "<font color=red>Failed to change password.</font><br />";
                        sessionhand::forgotpwform($username,$fname,$lname,$email);
                    }
                }
                else
                {
                    echo "<font color=red>Failed to change password.</font><br />";
                    sessionhand::forgotpwform($username,$fname,$lname,$email);
                }
            }
            else
            {
                echo "<font color=red>Failed to change password.</font><br />";
                sessionhand::forgotpwform($username,$fname,$lname,$email);
            }
            
        }
                
    }
}
?>

---

site.functions.php

Spoiler:

PHP Code:

---

<?php
class site
{
    function dbconnect()
    {
        $settings = parse_ini_file('settings.ini');
        $host    = $settings['host'];
        $db        = $settings['db'];
        $user    = $settings['username'];
        $pass    = $settings['password'];
        $con    = mysql_connect($host,$user,$pass);
        mysql_select_db($db, $con);    
    }
    function domain()
    {
        $settings = parse_ini_file('settings.ini');
        $domain    = $settings['domain'];
        
        return $domain;    
    }
    function encryptpassword($password)
    {
        $pw = strip_tags(substr($password,0,15));
        
        $cleanpw = md5($pw);
        
        return $cleanpw;
    }
    function mynl2br($text)
    { 
    return strtr($text, array("\r\n" => '<br />', "\r" => '<br />', "\n" => '<br />')); 
    } 
    function formatPhone($num)
    {
        $num = preg_replace('/[^0-9]/', '', $num);
    
        $len = strlen($num);
        if($len == 7)
    {
        $num = preg_replace('/([0-9]{3})([0-9]{4})/', '$1-$2', $num);
    }
    elseif($len == 10)
    {
        $num = preg_replace('/([0-9]{3})([0-9]{3})([0-9]{4})/', '($1) $2-$3', $num);
    }
    else
    {
        $num = "N/A";
    }
        return $num;
    } 
}

?>

---

site.manage.php

Spoiler:

PHP Code:

---

<?php
class admin
{
    function manage()
    {
        if(AUTH_3)
        {
            admin::level3(0, "list");
        }
        else
        {
            echo "<font color=red>You are not authorized to view this page.</font>";
        }    
    }
    function level3($data, $data2)
    {
        if(AUTH_3)
        {
            $sessuid = $_SESSION["uid"];
            $sessuid = preg_replace("/[^0-9]/","", $sessuid);
            if($data == 0 && $data2 == "list")
            {
                $query    = mysql_query("SELECT * FROM users WHERE UID != '".$sessuid."' ORDER BY UID ASC");
                if(!$query)
                {
                    echo "<font color=red>An error occurred, refresh the page and try again.</font>";
                }
                else
                {
                    echo "<table>";
                    while($result = mysql_fetch_assoc($query))
                    {        
                    $uid    = $result['UID'];
                    $id        = $result['ID'];
                    $fname    = $result['Fname'];
                    $lname    = $result['Lname'];
                    $email    = $result['Email'];
                    $auth    = $result['AUTH'];
                    $sid    = $result['SID'];
                    
                    echo "<tr><td align=left><a href=\"index.php?page=portal&option=manage&option2=selected&uid=".$uid."\">".$uid.": ".$lname.", ".$fname."</a></td></tr>";                                    
                    }    
                    echo "</table>";                
                }
            }
            elseif($data2 == "selected")
            {
                $query = mysql_query("SELECT * FROM users WHERE UID ='".$data."'");
                if(!$query)
                {
                    echo "<font color=red>An error occurred, refresh the page and try again.</font>";
                }
                else
                {
                    $result = mysql_fetch_assoc($query);
                    
                    $uid    = $result['UID'];
                    $id        = $result['ID'];
                    $fname    = $result['Fname'];
                    $lname    = $result['Lname'];
                    $email    = $result['Email'];
                    $auth    = $result['AUTH'];
                    $sid    = $result['SID'];
                    

                    echo "<br />You must have Javascript enabled in order to delete users.
                    <table><form action=\"index.php?page=portal&option=manage&option2=submitedit&uid=".$uid."\" method=\"post\">
                    <tr><td align=\"right\">Username:</td><td colspan=\"2\"><input type=\"text\" name=\"username\" maxlength=\"10\" value=\"".$id."\" /></td></tr>
                    <tr><td align=\"right\">First Name:</td><td colspan=\"2\"><input type=\"text\" name=\"fname\" maxlength=\"15\" value=\"".$fname."\" /></td></tr>
                    <tr><td align=\"right\">Last Name:</td ><td colspan=\"2\"><input type=\"text\" name=\"lname\" maxlength=\"15\" value=\"".$lname."\" /></td></tr>
                    <tr><td align=\"right\">Email:</td><td colspan=\"2\"><input type=\"text\" name=\"email\" maxlength=\"35\" value=\"".$email."\" /></td></tr>
                    <tr><td align=\"right\">Student ID:</td><td colspan=\"2\"><input type=\"text\" name=\"sid\" maxlength=\"10\" value=\"".$sid."\" /></td></tr>
                    <tr><td align=\"right\">Authorization:</td><td colspan=\"2\"><select name=\"auth\"";
                    if($auth >= 3)
                    {
                        echo " disabled=\"disabled\">";
                    }
                    else
                    {
                        echo ">";
                    }
                    
                    if($auth == 0)
                    {
                        echo "<option selected=\"yes\" value=\"0\">Level 0</option>";
                    }
                    else
                    {
                        echo "<option value=\"0\">Level 0</option>";
                    }
                    if($auth == 1)
                    {
                        echo "<option selected=\"yes\" value=\"1\">Level 1</option>";
                    }
                    else
                    {
                        echo "<option value=\"1\">Level 1</option>";
                    }
                    if($auth == 2)
                    {
                        echo "<option selected=\"yes\" value=\"2\">Level 2</option>";
                    }
                    else
                    {
                        echo "<option value=\"2\">Level 2</option>";
                    }
                    if($auth >= 3)
                    {
                        echo "<option selected=\"yes\" value=\"".$auth."\">Level ".$auth."</option>
                        <input type=\"hidden\" name=\"auth\" value=\"".$auth."\">";
                    }

                    echo "</td><tr><td align=\"center\"><input type=\"submit\" value=\"Submit\"></td>
                            <td></form><form method=\"POST\" name=\"deleteuserform\" action=\"index.php?page=portal&option=manage&option2=deleteuser&uid=".$uid."\"></td>
                            <td align=\"center\"><input type=\"hidden\" name=\"uid\" value=\"".$uid."\"><input type=\"button\" onclick=\"return userDelete('".$id."')\" value=\"Delete\" /></form></td></tr>
                        </table>";

                }
            }
            elseif($data2 == "submitedit")
            {
                $uid     = $_GET['uid'];
                $id     = $_POST['username'];
                $fname    = $_POST['fname'];
                $lname    = $_POST['lname'];
                $email    = $_POST['email'];
                $auth    = $_POST['auth'];
                $sid    = $_POST['sid'];
                if(ctype_alnum($uid) && ctype_alnum($id) && ctype_alnum($fname) && 
                    ctype_alnum($lname) && ctype_alnum($auth) && ctype_alnum($sid) &&
                    filter_var($email, FILTER_VALIDATE_EMAIL) == true)
                {
                    $query = mysql_query("UPDATE users SET ID = '".$id."', Fname = '".$fname."', Lname = '".$lname."', Email = '".$email."', AUTH = '".$auth."', SID = '".$sid."' WHERE UID = '".$uid."'");
                    if(!query)
                    {
                        echo "<font color=red>Something went wrong while updating the user.</font>";
                        admin::level3($uid, "selected");
                    }
                    else
                    {
                        echo "<font color=green>User successfully updated.</font>";
                        admin::level3($uid, "selected");
                    }
                }
                else
                {
                    echo "<font color=red>Something went wrong while updating the user.</font>";
                    admin::level3($uid, "selected");
                }
            }
            elseif($data2 == "deleteuser")
            {
                $uid    = $_POST['uid'];
                if ($uid == $data)
                {
                    if(ctype_alnum($uid))
                    {
                        $query = mysql_query("DELETE FROM users WHERE UID = ".$uid);
                        if(!$query)
                        {
                            echo "<font color=red>Something went wrong while deleting the user.</font>";
                            admin::manage();
                        }
                        else
                        {
                            echo "<font color=green>User successfully deleted.</font>";
                            admin::manage();
                        }
                    }
                }
            }
        }
    }
}
?>

---

site.constant.php

Spoiler:

PHP Code:

---

<?php

define("LOGGED_IN", (isset($_SESSION["username"]) && sessionhand::verifyuser($_SESSION["username"])));
define("AUTH_1", (sessionhand::verifyauth($_SESSION["username"], 1)));
define("AUTH_2", (sessionhand::verifyauth($_SESSION["username"], 2)));
define("AUTH_3", (sessionhand::verifyauth($_SESSION["username"], 3)));

class jscript
{
    function header()
    {
        echo "
        <script type=\"text/javascript\">
        function userDelete(uName) 
        {
            if (confirm(\"Are you sure you want to delete \" + uName + \"?\")) 
            {
                document.deleteuserform.submit();
            }
        }
        function ticketDelete() 
        {
            if (confirm(\"Are you sure you want to delete this ticket?\")) 
            {
                document.deleteticketform.submit();
            }
        }
        function ticketArchive() 
        {
            if (confirm(\"Are you sure you want to archive this ticket?\")) 
            {
                document.archiveticketform.submit();
            }
        }
        </script>";
    }
}
?>

---

settings.ini

Spoiler:

Code:

---

host        = localhost
db          = tech
username    = root
password    = password
domain        = http://techteam.dyndns.biz
secret        = techxteam1

---

site.design.php

Spoiler:

PHP Code:

---

<?php
class design
{
    function page($page)
    {
        echo "<!--[if IE]>
<div align=\"center\">        
<![endif]-->";
        echo "    <link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\"/>        
                <div class=\"nav_holder\">
                    <div class=\"nav_content\">
                        <div id=\"container\">
                            <ul id=\"navigation\">
                                <li><a href=\"index.php?page=home\">Home</a></li>
                                <li><a href=\"index.php?page=repair\">Tickets</a></li>
                                <li><a href=\"index.php?page=portal\">Portal</a></li>
                            </ul>
                        </div>
                    </div>
                </div>
                
                <div id=\"content\">
                      <div id=\"left\">
                        <div class=\"side_content_menu\">
                                <div align=\"right\">";
                    if($page == "portal")
                    {
                        echo "<div class=\"side_content\">
                        <ul class=\"list_side\">
                        <li><a href=\"index.php?page=portal&option=timeclock\">Time Clock</a></li>                        
                        <li><a href=\"index.php?page=portal&option=manage\">Manage</a></li>
                        <li><a href=\"index.php?page=register\">Register</a></li>
                        </ul>
                        </div>";                        
                    }
                    elseif($page == "repair")
                    {
                        echo "<div class=\"side_content\">
                        <ul class=\"list_side\">
                        <li><a href=\"index.php?page=repair&option=check\">Check</a></li>                        
                        <li><a href=\"index.php?page=repair&option=create\">Create</a></li>
                        <li><a href=\"index.php?page=repair&option=archive\">Archive</a></li>
                        </ul>
                        </div>";                        
                    }
                    else
                    {
                        
                    }
        echo "
                                </div>
                                <div align=\"center\">
                                </div>
                        </div>
                    </div>
                    <div id=\"center\">                    
                    <div class=\"center_content\">
                    <div align=\"center\">";
            
    }
    function endpage()
    {
        echo "</div></div></div>
                        <div id=\"site_footer\">
                            Created by: Zach Kemppel
                        </div>                        
                    </div>
                </div>
                <!--[if IE]>
                </div>
                <![endif]-->
                ";
    }
    function homepage()
    {
        echo "<font size=\"3\">To check the current status of your computer's repair, insert the 4 digit ticket number you received when you dropped off your computer.</font><br/>";
        echo "<form action=\"index.php\" method=\"get\">
                <input type=\"hidden\" name=\"page\" value=\"ticket\">
                <input type=\"hidden\" name=\"option\" value=\"check\">
                <input type=\"text\" name=\"tid\" maxlength=\"4\">
                <input type=\"submit\" value=\"Check\">
                </form>";
    }    
}
?>

---

It works, find a better theme.

Are you going to release this open source?

If you're actually interested in the source then I can make a release.

Wow no real feedback? Figured this community would rip me a new one on my first showcase.

Not bad at all.

They don't come down on you until you release something / have a demo. :P

As a customer, I'd want to see something that looks a little more professional. Google for some free templates. You'll find a lot of great stuff.

Allright, let's take a look.
Well, first off I want to welcome you out of the KalOnline section and into the Coders Paradise :).

Secondly, the site looks fine, I would however try (as others have pointed out) to modify the design a little, it's not too bad atm, however try looking into the following things:
- Better color scheme.
- Try removing the boxes on the sides, don't see the purpose of them.

Other than that it's not too bad, if it works, then fine :). I would however try to remake the layout and design in general.

Oh and, we are very friendly here :) this section is far friendlier than KalOnline so dw :).

Quote:

---

Originally Posted by Justei

Allright, let's take a look.
Other than that it's not too bad, if it works, then fine :).:).

---

I put a link to it with a username/password for people to try it out. Like I said, the layout was just for me while I was working on it, I do plan on finding a better one. Thanks for the feedback.

The idea of a ticketing system to keep track of your repairs is good.
As previously stated the layout needs some work to it, or perhaps change it all together.

If you could setup a demo so we could fully see how this works and functions, that would be great, I'm sure then I could give you some more feedback on this. Good luck.

As Justei said, work on the layout.

1) Remove the side boxes.

2) Change the background... possibly to just a static color.

3) Move the "Hello name" and Logout buttons to the top right.

4) Use <noscript> (or similar) HTML syntax to show an error if the user has javascript disabled. Currently, if you have javascript disabled and try to create a ticket, the center of the page is empty, instead of the form.

5) Fancying up some of the CSS just a tad could go a long way. Border radiuses, shadows perhaps, some padding, etc.

Guys I get it, the template sucks lol. I'm asking for feedback on the actual system itself. I put a username and password in the first post for you all to test it out. I haven't included any type of javascript in my source, so I'll have to look into that. I appreciate the feedback, I really do, but use the login I gave to test out the ticketing system.

For background gradient try to choose base color and instead of going (*color* -> white) do something like (*color* -> darker/brigther *color*)

At my internship, they use stickers instead of plain tickets. They paste them on the PC itself so it's almost impossible to loose it.

Add 2 pages; 1 with "About us" and a "Contact" page to fill the nav. It looks kinda empty now.

Quote:

---

Originally Posted by jM2.me

For background gradient try to choose base color and instead of going (*color* -> white) do something like (*color* -> darker/brigther *color*)

---

Quote:

---

Originally Posted by zkemppel

Guys I get it, the template sucks lol. I'm asking for feedback on the actual system itself. I put a username and password in the first post for you all to test it out. I haven't included any type of javascript in my source, so I'll have to look into that. I appreciate the feedback, I really do, but use the login I gave to test out the ticketing system.

---

Don't make him repeat himself, lol.

Quote:

---

Originally Posted by Samus.

Don't make him repeat himself, lol.

---

I have no idea how I missed his last post. Sorry :$:

Offtopic: pic in your signature is hilarious :lol:

Quote:

---

Originally Posted by Samus.

At my internship, they use stickers instead of plain tickets. They paste them on the PC itself so it's almost impossible to loose it.

Add 2 pages; 1 with "About us" and a "Contact" page to fill the nav. It looks kinda empty now.





Don't make him repeat himself, lol.

---

We put a post-it on each computer with ticket number. This website is so we can keep track of what we've done for each computer so far, and so the customer can track the status of the repair also. There's still plenty of pages I need to add, the "About us" page definitely being one of them.

Quote:

---

Originally Posted by jM2.me

I have no idea how I missed his last post. Sorry :$:

Offtopic: pic in your signature is hilarious :lol:

---

It's no problem lol, just looking for something other than "your 5 minute quick template is crap." Trying to get this site into production by January since I'll be graduating (Computer Networking: Systems & Applications major).

Working on re-doing the login to be integrated in the top menu.

Added the source in the first post. Go easy on me, lol.

1. I don't comment anything... sorry in advance.
2. I realize now I could have done stuff a whole lot differently, but I didn't want to go back and re-do it all.

PHP Code:

---

$tid        = $_POST['tid'];
$tid        = preg_replace("/[^0-9]/","", $tid); 


---

What is this and why are you doing it?

Quote:

---

Originally Posted by AngraMainyu

PHP Code:

---

$tid        = $_POST['tid'];
$tid        = preg_replace("/[^0-9]/","", $tid); 


---

What is this and why are you doing it?

---

removing any character that is not numeric.

I can use a for-loop in those $_POST to shrink the code, also can't you do this:

PHP Code:

---

$tid = preg_replace("/[^0-9]/", "", $_POST['tid']); 


---

Why add it to a variable o.O?

Quote:

---

Originally Posted by iAkira

I can use a for-loop in those $_POST to shrink the code, also can't you do this:

PHP Code:

---

$tid = preg_replace("/[^0-9]/", "", $_POST['tid']); 


---

Why add it to a variable o.O?

---

Because I'm still not a pro lol, this code is actually more condensed than it originally was. I'll fix all that tho.

I tried.. o.O? anyways, I'll recheck this tomorrow for more ways to shrink this. Goodnight.

Quote:

---

Originally Posted by iAkira

I tried.. o.O? anyways, I'll recheck this tomorrow for more ways to shrink this. Goodnight.

---

thanks for the input

So I turned this:

PHP Code:

---

            $tid        = $_POST['tid'];
            $tid        = preg_replace("/[^0-9]/","", $tid);
            $brand   = $_POST['brand'];
            $brand   = preg_replace("/[^A-Za-z0-9]/", "", $brand);
            $serial        = $_POST['serial'];
            $serial        = preg_replace("/[^A-Za-z0-9]/", "", $serial);
            $fname        = $_POST['fname'];
            $fname        = preg_replace("/[^A-Za-z0-9]/", "", $fname);
            $lname        = $_POST['lname'];
            $lname        = preg_replace("/[^A-Za-z0-9]/", "", $lname);
            $phone        = $_POST['phone'];
            $phone1        = preg_replace("/[^0-9]/","", $phone);
            $serial        = $_POST['serial'];
            $serial        = preg_replace("/[^A-Za-z0-9]/", "", $serial);
            $comments    = $_POST['comments'];
            $comments    = mysql_real_escape_string($comments);
            $backup        = $_POST['backup'];
            $backup        = preg_replace("/[^0-9]/","", $backup);
            $virus        = $_POST['virus'];
            $virus        = preg_replace("/[^0-9]/","", $virus);
            $install    = $_POST['install'];
            $install    = preg_replace("/[^0-9]/","", $install);        
            $email        = $_POST['email'];
            
            if (filter_var($email, FILTER_VALIDATE_EMAIL)  == TRUE) 
            {
                $email = $email;
            }
            else
            {
                $email = preg_replace("/[^A-Za-z0-9]/", "", $email);
            } 


---

into this:

PHP Code:

---

            $tid        = preg_replace("/[^0-9]/","", $_POST['tid']);
            $brand        = preg_replace("/[^A-Za-z0-9]/","", $_POST['brand']);
            $serial        = preg_replace("/[^A-Za-z0-9]/","", $_POST['serial']);
            $fname        = preg_replace("/[^A-Za-z0-9]/","", $_POST['fname']);
            $lname        = preg_replace("/[^A-Za-z0-9]/","", $_POST['lname']);
            $phone1        = preg_replace("/[^0-9]/","", $_POST['phone']);
            $serial        = preg_replace("/[^A-Za-z0-9]/","", $_POST['serial']);
            $backup        = preg_replace("/[^0-9]/","", $_POST['backup']);
            $virus        = preg_replace("/[^0-9]/","", $_POST['virus']);
            $install    = preg_replace("/[^0-9]/","", $_POST['install']);
            $comments    = mysql_real_escape_string($_POST['comments']);                
            $email        = $_POST['email'];
            
            if (filter_var($email, FILTER_VALIDATE_EMAIL)  != TRUE) 
            {
                $email = preg_replace("/[^A-Za-z0-9]/", "", $email);
            } 


---

Looks good, they codes are pretty clean enough

You could use switch statement on the index page.

Something like:

PHP Code:

---

switch($option)
{
case "create":
{
            if(isset($_POST['createticket']))
            {
            tickets::createticket();
            }
            else
            {
            tickets::ticketform();
            }
break;
        }

case "check":
{
            if($option2 == "selected")
            {
                tickets::checkticket($tid, "tickets");
            }
            else
            {
                tickets::checkticket(0, "tickets");
            }
break;
        }

...and so on. 


---

Haven't coded PHP so I don't know if there is something else wrong with the code but using switch statements instead of piles and piles of elseifs makes the code more readable.

@Splitter
It wouldn't do much of anything for him IMO, and if/elseif/else is quicker than switch statements.

@zkemppel
I made it much more readable for you.

PHP Code:

---

<?php
function makeNumerical($input)
{
    return preg_replace("/[^0-9]/","", $input);
}

function makeAlphanumerical($input)
{
    return preg_replace("/[^A-Za-z0-9]/","", $input);
}

$tid      = makeNumerical($_POST['tid']);
$phone1   = makeNumerical($_POST['phone']);
$backup   = makeNumerical($_POST['backup']);
$virus    = makeNumerical($_POST['virus']);
$install  = makeNumerical($_POST['install'])
$brand    = makeAlphanumerical($_POST['brand']);
$serial   = makeAlphanumerical($_POST['serial']);
$fname    = makeAlphanumerical($_POST['fname']);
$lname    = makeAlphanumerical($_POST['lname']);
$serial   = makeAlphanumerical($_POST['serial']);;
$comments = mysql_real_escape_string(htmlentities($_POST['comments'])); // NOTE: I added htmlentities here to avoid HTML/XSS injection
$email    = $_POST['email'];

if (! filter_var($email, FILTER_VALIDATE_EMAIL)) {
    $email = makeAlphanumerical($email);
} 
?>

---

You need to learn to separate the PHP from HTML better. Even if you can't wrap your mind around a simple template class, then at least take them out of the echo. Echo's shouldn't be big HTML blocks like that. Just keep it out of the PHP tags.

I recommend you learn better code management and organization. Looking into design patterns could prove very beneficial for you.

Also, I would recommend trying to start conforming to PEAR Standards.
s-p-n brought it to my attention recently, and, although my coding style was similar to PEAR standards, reading up on it and doing my best to practice it at all times really has made my code more readable for me in the now, as well as when I go back to look at it a few days later, and especially for other developers.

You obviously don't have to follow all the rules and standards, but some of the basics are well thought out and just plain look nice and make writing PHP less confusing at times.
Just by taking using the PEAR Control Standards(i.e. if/elseif/else statement, switch statement, etc.. standards), you can lower the amount of lines in your code, and make it more readable.

Quote:

---

Originally Posted by timebomb

You need to learn to separate the PHP from HTML better. Even if you can't wrap your mind around a simple template class, then at least take them out of the echo. Echo's shouldn't be big HTML blocks like that. Just keep it out of the PHP tags.

I recommend you learn better code management and organization. Looking into design patterns could prove very beneficial for you.

Also, I would recommend trying to start conforming to PEAR Standards.
s-p-n brought it to my attention recently, and, although my coding style was similar to PEAR standards, reading up on it and doing my best to practice it at all times really has made my code more readable for me in the now, as well as when I go back to look at it a few days later, and especially for other developers.

You obviously don't have to follow all the rules and standards, but some of the basics are well thought out and just plain look nice and make writing PHP less confusing at times.
Just by taking using the PEAR Control Standards(i.e. if/elseif/else statement, switch statement, etc.. standards), you can lower the amount of lines in your code, and make it more readable.

---

This is the type of feedback I've been looking for, thank you. I have no formal training in PHP which is probably why it's roughly put together.

Ok, so it seems that timebomb has covered most of my points already, but here is what else I have:

-----------

The first thing I noticed after logging in is that the code to check is only 4 digits long and all numeric - this is a problem!

After entering 0069 (I think) I was shown the following:

Code:

---

Name:        john smith
Phone #: (123) 456-7890
Email:  test@test.com

---

This should never be accessible, except by the person who the details belong to. You do not need to include any of this data in the external page, where anyone who can guess/brute force the input box can "farm" personal details.

-----------

I feel you are not seperating the admin functionality from the user functionality enough.

I mean, you have all these IF statements to validate staff, when really, you could just make a user.php and a staff.php and lock down the staff page, preferably by .htaccess

-----------

I also think you have too many classes in seperate files, but maybe that is because I have my own framework that I work within now that only requires me to have a database class and an authorization class. You seem to have classes in numerous pages. I would definitely merge some of those, based on their logic and downsize the file count.

-----------

You should also consider having a single included file, with all other includes put into that.

Right now, this is no problem for you due to the site size, but it is good practice to get into because one day, should you run a big site and include files on individual pages, you only have to remove an include from one file instead of multiple.

Sure, you could just empty data from the file and leave the file there, but in a commercial environment, that is not acceptable IMO.

-----------

Hope my input helps you, if only a little.

Regards,
Luke