<? include "verify.php" ?>
<?
include "conn.php";
include "security.php";

$action = sec_addESC($_POST["action"]);
$id = sec_addESC($_POST["id"]);

$username = sec_addESC($_POST["username"]);
$password = sec_addESC($_POST["password"]);
$password_again = sec_addESC($_POST["password_again"]);
$access_level = sec_addESC($_POST["access_level"]);
$email = sec_addESC($_POST["email"]);


if ($action == "edit" ){
	$sql = "UPDATE users SET username = '$username', access_level = '$access_level', email = '$email' WHERE id = '$id' ";
	$conn = mysql_query($sql);
	
	if ($password != "" AND $password == $password_again) {
		$sql = "UPDATE users SET password = md5('$password') WHERE id = '$id' ";
		$conn = mysql_query($sql);
	}
	
} else if ($action == "new" ){
	if ($password != "" AND $password == $password_again) {
		$sql = "INSERT INTO users (username,password,access_level, email) VALUES ('$username',md5('$password'),'$access_level','$email')";
		$conn = mysql_query($sql);
	} else{
		header("Location: error.php"); 
	}
}

header("Location: user_config_list.php"); 


?>