<?

if (!isset($_GET['ank'])){
$usearch=NULL;
if (isset($_SESSION['usearch']))$usearch=$_SESSION['usearch'];
if (isset($_POST['usearch']))$usearch=$_POST['usearch'];
if ($usearch==NULL)
unset($_SESSION['usearch']);
else
$_SESSION['usearch']=$usearch;
$usearch=ereg_replace("( ){1,}","",$usearch);
}

if (isset($_GET['ank'])) $ank['id']=intval($_GET['ank']);

if (isset($_GET['ank'])) $ank=mysql_fetch_array(mysql_query("SELECT * FROM `user` WHERE `id` = '$ank[id]'"));
else
$ank=mysql_fetch_array(mysql_query("SELECT * FROM `user` WHERE `nick` like '%".mysql_escape_string($usearch)."%'"));


$gifts['id']=intval($_GET['id_gifts']);

$msg = mysql_real_escape_string($_POST['msg']);

if (isset($_POST['msg']) && strlen2(esc(stripcslashes(htmlspecialchars($_POST['msg']))))<=255)
{


if($ank==0) msg ('Пользователь не найден');
else
if (isset($user) & $user['balls']<=1000) msg ('У Вас не достаточно VM');
else
{
mysql_query("UPDATE `user` SET `balls` = '".($user['balls']-1000)."' WHERE `id` = '$user[id]' LIMIT 1");
mysql_query("INSERT INTO `fin_oper` (`user`, `oper`, `time`, `cena`) values('$user[id]', 'Отправили подарок для $ank[nick]', '$time', '1000')",$db);
mysql_query("INSERT INTO `gift_send` (`gift_id`, `id_user`, `time`, `id_send`, `msg`, `read`) values('$gifts[id]', '$user[id]', '$time', '$ank[id]', '$msg', '0')",$db);
msg ('Подарок отправлен');
}
}

echo "<img src='/gifts/$gifts[id].png' alt=''/><br/>";

if (isset($_GET['ank']))
{
echo "<form method=\"post\" action=\"gifts.php?p=send_gifts&amp;id_gifts=$gifts[id]&amp;ank=$ank[id]\">";
echo "Ник получателя $ank[nick]<br/>\n";

}
else
echo "<form method=\"post\" action=\"gifts.php?p=send_gifts&amp;id_gifts=$gifts[id]\">";
if (!isset($_GET['ank'])) echo "Ник получателя<br/><input type=\"text\" name=\"usearch\" maxlength=\"16\" value=\"\" /><br/>\n";
echo "Текст сообщения:<br/>";
echo "<input type=\"text\" name=\"msg\" value=\"\"/><br />\r\n";
echo "<input type=\"submit\" value=\"Отправить\" />";
echo "</form>\n";

echo "С вашего счета будет снято 1000 VM<br />\n";

?>
