PHP

<?php
session_start();
date_default_timezone_set("Asia/Kolkata");

$db = new mysqli("localhost", "root", "", "cms");
$db->set_charset("utf8mb4");

const LEVELS = [1 => "User", 2 => "Moderator", 3 => "Administrator"];

function e(?string $s): string                       // escape for HTML output
{
    return htmlspecialchars($s ?? "", ENT_QUOTES, "UTF-8");
}
function user(): ?array                              // the logged-in user or null
{
    return $_SESSION["user"] ?? null;
}
function require_level(int $level): void            // protect a page
{
    if (!user() || user()["access_level"] < $level) {
        header("Location: login.php");
        exit;
    }
}
function flash(?string $msg = null): ?string         // one-time message
{
    if ($msg !== null) { $_SESSION["flash"] = $msg; return null; }
    $m = $_SESSION["flash"] ?? null;
    unset($_SESSION["flash"]);
    return $m;
}

<!DOCTYPE html>
<html><head><meta charset="utf-8"><title><?= e($title ?? "CMS") ?></title>
<style>
 body{font-family:Arial;font-size:13px;margin:0;width:600px}
 .top{background:#173b6c;color:#fff;padding:8px} .top a{color:#ffd483;margin-right:8px}
 .main{padding:8px} .flash{background:#e7f6ec;border:1px solid #9c9;padding:4px}
 .art{border-bottom:1px solid #ccc;padding:4px 0} small{color:#666}
</style></head>
<body>
<div class="top"><b>PHP CMS</b> &nbsp;
  <a href="index.php">Home</a>
  <?php if (user()): ?>
    <a href="compose.php">Compose</a>
    <?php if (user()["access_level"] >= 2): ?><a href="pending.php">Pending</a><?php endif; ?>
    <?php if (user()["access_level"] >= 3): ?><a href="admin.php">Admin</a><?php endif; ?>
    <a href="logout.php">Logout</a>
    <small style="color:#fff">(<?= e(user()["name"]) ?>, <?= LEVELS[user()["access_level"]] ?>)</small>
  <?php else: ?>
    <a href="login.php">Login</a> <a href="register.php">Register</a>
  <?php endif; ?>
</div>
<div class="main">
<?php if ($m = flash()): ?><p class="flash"><?= e($m) ?></p><?php endif; ?>

</div>
<div style="border-top:1px solid #ccc;padding:4px 8px"><small>&copy; <?= date("Y") ?> PHP CMS</small></div>
</body></html>

<?php
require "inc/config.php";
$hash = password_hash("Admin@123", PASSWORD_DEFAULT);
$db->execute_query(
    "INSERT INTO cms_users (name, email, password, access_level) VALUES (?, ?, ?, 3)",
    ["Site Admin", "admin@cms.test", $hash]);
echo "Administrator created with id " . $db->insert_id . ". Delete setup.php now!";

<?php
require "inc/config.php";
$errors = [];
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $name  = trim($_POST["name"] ?? "");
    $email = trim($_POST["email"] ?? "");
    $pass  = $_POST["password"] ?? "";
    if (strlen($name) < 3)                          $errors[] = "Name must have at least 3 characters.";
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = "Invalid e-mail address.";
    if (strlen($pass) < 8)                          $errors[] = "Password must have at least 8 characters.";
    if (!$errors) {
        try {
            $db->execute_query("INSERT INTO cms_users (name, email, password) VALUES (?, ?, ?)",
                               [$name, $email, password_hash($pass, PASSWORD_DEFAULT)]);
            flash("Registration successful. Please log in.");
            header("Location: login.php");
            exit;
        } catch (mysqli_sql_exception $ex) {
            $errors[] = $ex->getCode() == 1062 ? "This e-mail is already registered." : "Registration failed.";
        }
    }
}
$title = "Register";
require "inc/header.php";
?>
<h3>Register</h3>
<?php foreach ($errors as $er): ?><div style="color:#c00"><?= e($er) ?></div><?php endforeach; ?>
<form method="post">
  Name <input name="name" id="name" value="<?= e($_POST["name"] ?? "") ?>"><br>
  E-mail <input name="email" id="email" value="<?= e($_POST["email"] ?? "") ?>"><br>
  Password <input type="password" name="password" id="password"><br>
  <input type="submit" value="Register" id="go">
</form>
<?php require "inc/footer.php"; ?>

<?php
require "inc/config.php";
$error = "";
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $row = $db->execute_query("SELECT user_id, name, email, password, access_level
                               FROM cms_users WHERE email = ?", [$_POST["email"] ?? ""])->fetch_assoc();
    if ($row && password_verify($_POST["password"] ?? "", $row["password"])) {
        session_regenerate_id(true);
        unset($row["password"]);                    // never keep the hash in the session
        $_SESSION["user"] = $row;
        flash("Welcome, " . $row["name"] . "!");
        header("Location: index.php");
        exit;
    }
    $error = "Wrong e-mail or password.";
}
$title = "Login";
require "inc/header.php";
?>
<h3>Login</h3>
<div style="color:#c00"><?= e($error) ?></div>
<form method="post">
  E-mail <input name="email" id="email"> Password <input type="password" name="password" id="password">
  <input type="submit" value="Login" id="go">
</form>
<?php require "inc/footer.php"; ?>

<?php
require "inc/config.php";
$_SESSION = [];
session_destroy();
session_start();
flash("You have been logged out.");
header("Location: index.php");

<?php
require "inc/config.php";
$articles = $db->query(
    "SELECT a.article_id, a.title, a.body, a.publish_date, u.name,
            (SELECT COUNT(*) FROM cms_comments c WHERE c.article_id = a.article_id) AS comments
     FROM cms_articles a JOIN cms_users u ON a.user_id = u.user_id
     WHERE a.is_published = 1
     ORDER BY a.publish_date DESC LIMIT 10");
$title = "Home";
require "inc/header.php";
?>
<h3>Latest articles</h3>
<?php if ($articles->num_rows == 0): ?>
  <p>No articles have been published yet.</p>
<?php endif; ?>
<?php foreach ($articles as $a): ?>
  <div class="art">
    <a href="article.php?id=<?= $a["article_id"] ?>"><b><?= e($a["title"]) ?></b></a><br>
    <small>by <?= e($a["name"]) ?> on <?= date("d M Y, h:i A", strtotime($a["publish_date"])) ?>
           · <?= $a["comments"] ?> comment(s)</small><br>
    <?= e(mb_strimwidth($a["body"], 0, 120, "…")) ?>
  </div>
<?php endforeach; ?>
<?php require "inc/footer.php"; ?>

<?php
require "inc/config.php";
require_level(1);                                    // any logged-in user
$error = "";
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $t = trim($_POST["title"] ?? "");
    $b = trim($_POST["body"] ?? "");
    if ($t === "" || strlen($b) < 20) {
        $error = "Please enter a title and at least 20 characters of text.";
    } else {
        $db->execute_query("INSERT INTO cms_articles (user_id, submit_date, title, body)
                            VALUES (?, NOW(), ?, ?)", [user()["user_id"], $t, $b]);
        flash("Article #" . $db->insert_id . " submitted. It is pending until a moderator publishes it.");
        header("Location: index.php");
        exit;
    }
}
$title = "Compose";
require "inc/header.php";
?>
<h3>Compose an article</h3>
<div style="color:#c00"><?= e($error) ?></div>
<form method="post">
  Title<br><input name="title" id="title" size="50"><br>
  Text<br><textarea name="body" id="body" rows="5" cols="60"></textarea><br>
  <input type="submit" value="Submit for review" id="go">
</form>
<?php require "inc/footer.php"; ?>

<?php
require "inc/config.php";
require_level(2);                                    // moderators and administrators
$rows = $db->query("SELECT a.article_id, a.title, a.submit_date, u.name
                    FROM cms_articles a JOIN cms_users u ON a.user_id = u.user_id
                    WHERE a.is_published = 0 ORDER BY a.submit_date");
$title = "Pending articles";
require "inc/header.php";
?>
<h3>Pending articles (<?= $rows->num_rows ?>)</h3>
<?php foreach ($rows as $r): ?>
  <div class="art"><a href="review.php?id=<?= $r["article_id"] ?>"><?= e($r["title"]) ?></a>
    <small>by <?= e($r["name"]) ?>, submitted <?= date("d M Y H:i", strtotime($r["submit_date"])) ?></small></div>
<?php endforeach; ?>
<?php require "inc/footer.php"; ?>

<?php
require "inc/config.php";
require_level(2);
$id = (int) ($_GET["id"] ?? $_POST["id"] ?? 0);
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $action = $_POST["action"] ?? "";
    if ($action === "delete") {
        $db->execute_query("DELETE FROM cms_articles WHERE article_id = ?", [$id]);
        flash("Article deleted.");
        header("Location: pending.php");
        exit;
    }
    $db->execute_query("UPDATE cms_articles SET title = ?, body = ? WHERE article_id = ?",
                       [trim($_POST["title"]), trim($_POST["body"]), $id]);
    if ($action === "publish") {
        $db->execute_query("UPDATE cms_articles SET is_published = 1, publish_date = NOW()
                            WHERE article_id = ?", [$id]);
        flash("Article published.");
        header("Location: index.php");
        exit;
    }
    flash("Changes saved.");
}
$a = $db->execute_query("SELECT * FROM cms_articles WHERE article_id = ?", [$id])->fetch_assoc();
if (!$a) { http_response_code(404); exit("Article not found"); }
$title = "Review";
require "inc/header.php";
?>
<h3>Review article #<?= $id ?> <small>(<?= $a["is_published"] ? "published" : "pending" ?>)</small></h3>
<form method="post">
  <input type="hidden" name="id" value="<?= $id ?>">
  <input name="title" id="title" size="50" value="<?= e($a["title"]) ?>"><br>
  <textarea name="body" id="body" rows="5" cols="60"><?= e($a["body"]) ?></textarea><br>
  <button name="action" value="save" id="save">Save</button>
  <button name="action" value="publish" id="publish">Publish</button>
  <button name="action" value="delete" id="delete">Delete</button>
</form>
<?php require "inc/footer.php"; ?>

<?php
require "inc/config.php";
$id = (int) ($_GET["id"] ?? 0);
if ($_SERVER["REQUEST_METHOD"] === "POST" && user()) {
    $c = trim($_POST["comment"] ?? "");
    if ($c !== "") {
        $db->execute_query("INSERT INTO cms_comments (article_id, user_id, comment_date, comment)
                            VALUES (?, ?, NOW(), ?)", [$id, user()["user_id"], $c]);
        flash("Thank you for your comment.");
    }
    header("Location: article.php?id=$id");          // Post/Redirect/Get
    exit;
}
$a = $db->execute_query("SELECT a.*, u.name FROM cms_articles a JOIN cms_users u USING (user_id)
                         WHERE a.article_id = ? AND a.is_published = 1", [$id])->fetch_assoc();
if (!$a) { http_response_code(404); exit("Article not found"); }
$comments = $db->execute_query("SELECT c.comment, c.comment_date, u.name
                                FROM cms_comments c JOIN cms_users u USING (user_id)
                                WHERE c.article_id = ? ORDER BY c.comment_date", [$id]);
$title = $a["title"];
require "inc/header.php";
?>
<h3><?= e($a["title"]) ?></h3>
<small>by <?= e($a["name"]) ?>, published <?= date("d M Y", strtotime($a["publish_date"])) ?></small>
<p><?= nl2br(e($a["body"])) ?></p>
<h4>Comments (<?= $comments->num_rows ?>)</h4>
<?php foreach ($comments as $c): ?>
  <div class="art"><b><?= e($c["name"]) ?></b> <small><?= date("d M H:i", strtotime($c["comment_date"])) ?></small><br>
  <?= e($c["comment"]) ?></div>
<?php endforeach; ?>
<?php if (user()): ?>
  <form method="post"><textarea name="comment" id="comment" rows="2" cols="50"></textarea><br>
  <input type="submit" value="Add comment" id="go"></form>
<?php else: ?>
  <p><a href="login.php">Log in</a> to comment.</p>
<?php endif; ?>
<?php require "inc/footer.php"; ?>

<?php
require "inc/config.php";
require_level(3);                                    // administrators only
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $uid = (int) $_POST["user_id"];
    $lvl = (int) $_POST["access_level"];
    if (isset(LEVELS[$lvl]) && $uid != user()["user_id"]) {      // cannot demote yourself
        $db->execute_query("UPDATE cms_users SET access_level = ? WHERE user_id = ?", [$lvl, $uid]);
        flash("Access level changed.");
    }
    header("Location: admin.php");
    exit;
}
$users = $db->query("SELECT u.user_id, u.name, u.email, u.access_level,
                     (SELECT COUNT(*) FROM cms_articles a WHERE a.user_id = u.user_id) AS articles
                     FROM cms_users u ORDER BY u.user_id");
$title = "Admin";
require "inc/header.php";
?>
<h3>Users</h3>
<table border="1" cellpadding="4" style="border-collapse:collapse">
<tr><th>Id</th><th>Name</th><th>E-mail</th><th>Articles</th><th>Access level</th></tr>
<?php foreach ($users as $u): ?>
<tr><td><?= $u["user_id"] ?></td><td><?= e($u["name"]) ?></td><td><?= e($u["email"]) ?></td>
  <td align="center"><?= $u["articles"] ?></td>
  <td><form method="post" style="margin:0">
        <input type="hidden" name="user_id" value="<?= $u["user_id"] ?>">
        <select name="access_level" id="lvl<?= $u["user_id"] ?>">
          <?php foreach (LEVELS as $k => $v): ?>
            <option value="<?= $k ?>" <?= $k == $u["access_level"] ? "selected" : "" ?>><?= $v ?></option>
          <?php endforeach; ?>
        </select> <input type="submit" value="Save" id="save<?= $u["user_id"] ?>">
      </form></td></tr>
<?php endforeach; ?>
</table>
<?php require "inc/footer.php"; ?>