01.<?
02.if(!$_GET){
03.$sql_p = "SELECT * FROM `product` ORDER BY id DESC";
04.$qry_p = mysql_query($sql_p);
05.while($rst_p = mysql_fetch_array($qry_p)){
06.echo "<div><img width='150' class='img-rounded' style='margin:10px; border:1px #333 solid;' src='".$rst_p["picture"]."' /><br> ชื่อ".$rst_p["name"]." - ".$rst_p["rank"]." - ".$rst_p["price"]."(<a href='?id=".$rst_p["code_id"]."'>สั่งซื้อ</a>)</div>";
07.}
08.} else{
09.
10. if($_GET){
11. if(isset($_GET["id"]) && !$_GET["act"] && !$_GET["cmd"]){
12. $sql_p = "SELECT * FROM `product` WHERE `code_id` LIKE '".mysql_real_escape_string($_GET["id"])."'";
13. $qry_p = mysql_query($sql_p);
14. $rst_p = mysql_fetch_array($qry_p);
15.
16. $sql_status = "SELECT * FROM `code` WHERE `code_id` LIKE '".mysql_real_escape_string($_GET["id"])."' AND `status`='1'";
17. $qry_status = mysql_query($sql_status);
18. $num_status = mysql_num_rows($qry_status);
19.
20. if($num_status){
21. $status = $num_status;
22. } else{
23. $status = "<font color='red'>หมด</font>";
24. }
25.
26. if($num_status){
27. $buy_btn = "<a href='?id=".mysql_real_escape_string($_GET["id"])."&act=buy'>สั่งซื้อ</a>";
28. }
29.
30. echo "<div style='border:#33 1px solid;'><img width='300' src='".$rst_p["picture"]."' /><br />ชื่อ : <strong>".$rst_p["name"]."</strong><br />ยศที่ต้องการ : <strong>".$rst_p["rank"]."</strong><br />ราคา : <strong>".$rst_p["price"]."</strong> บาท<br />สถานะ : <strong>".$status."</strong><br/></div>".$buy_btn;
31. }
32. if($_GET["id"] && $_GET["act"] && $_GET["act"]=="buy" && !$_GET["cmd"]){
33. $qry_c = mysql_query("SELECT * FROM `code` WHERE `code_id` LIKE '".mysql_real_escape_string($_GET["id"])."' AND `status`=1");
34. $num_c = mysql_num_rows($qry_c);
35.
36. if($num_c){
37. echo '<div align="center"><br /><br /><a class="btn btn-success btn-sm" href="?id='.mysql_real_escape_string($_GET["id"]).'&act=buy&cmd=confirm">ยืนยัน</a> | <a class="btn btn-danger btn-sm" href="itemcode.php">ยกเลิก</a></div>';
38. } else{
39. echo '<div align="center"><br /><br /><h1><font color="#FF0000">สินค้าหมด</font></h1><a class="btn btn-danger btn-sm" href="itemcode.php">กลับ</a></div>';
40. }
41. } else if($_GET["id"] && $_GET["act"] && $_GET["act"]=="buy" && $_GET["cmd"] && $_GET["cmd"]=="confirm"){
42.
43. $id_code = mysql_real_escape_string($_GET["id"]);
44.
45. $qry_a = mysql_query("SELECT * FROM account WHERE username LIKE '".$_SESSION["username"]."'");
46. $rst_a = mysql_fetch_array($qry_a);
47.
48.
49. $sql_p = "SELECT * FROM product WHERE code_id LIKE '".$id_code."'";
50. $qry_p = mysql_query($sql_p);
51. $rst_p = mysql_fetch_array($qry_p);
52.
53. if($rst_p["price"]>$rst_a["point"]){
54. echo 'ยอดเงินของคุณไม่พอ';
55. } else{
56.
57. $qry_c = mysql_query("SELECT * FROM `code` WHERE `code_id` LIKE '".$id_code."' AND `status`=1");
58. $num_c = mysql_num_rows($qry_c);
59. $rst_c = mysql_fetch_array($qry_c);
60.
61. $sql_buy = "UPDATE `".$config["db"]."`.`account` SET `point` = `point`-'".$rst_p["price"]."' WHERE `account`.`id` =".$_SESSION['id']." LIMIT 1 ;";
62. $sql_own = "INSERT INTO `".$config["db"]."`.`owner` (`id` ,`username` ,`price` ,`txid` ,`code_id` ,`code`,`date`)VALUES ";
63. $sql_own .= "(NULL,'".$_SESSION["username"]."','".$rst_p["price"]."','".strtoupper(uniqid())."','".$rst_c["code_id"]."','".$rst_c["code"]."','".date("Y-m-d H:i:s")."');";
64. $sql_sta = "UPDATE `".$config["db"]."`.`code` SET `status` = '0' WHERE `code`.`id` =".$rst_c["id"]." LIMIT 1 ;";
65.
66. if($num_c){
67. if(mysql_query($sql_buy) && mysql_query($sql_own) && mysql_query($sql_sta)){
68. echo '<div align="center"><h1>สั่งซื้อสำเร็จ</h1><a class="btn-xs btn btn-primary" href="history.php">ดูโค้ด</a></div>';
69. } else{
70. echo '<h1>ไม่สามารถสั่งซื้อได้</h1> (<a href="itemcode.php"><font color="#FF0000">ย้อนกลับ</font></a>)';
71. }
72. } else{
73. echo '<h1>สินค้าหมด</h1> (<a href="itemcode.php"><font color="#FF0000">ย้อนกลับ</font></a>)';
74. }
75.
76. }
77.
78.
79.
80. } else{
81. echo '<script>window.location="?id='.mysql_real_escape_string($_GET["id"]).'&act=buy";</script>';
82. }
83.
84. if(!$_GET["id"] && !$_GET["act"]){
85. die("404");
86. }
87.
88. }
89.
90.}
91.?>
