OdenseTrack/classes/get.class.php

<?php

/*
 * Gets various items from the database - Used on basically all pages.
 */

class Get {

    private function __construct() {
        
    }

    public static function NewsArticle($id) {
        /* Here we sanitize the userinput. We only allow numbers here.
         * - Filter the variable to remove anything but numbers (plusses and minusses)
         * However, the filter_var needs us to trim the output first, as we dont want nullbytes.
         */

        $newsitem = filter_var(trim($id), FILTER_SANITIZE_NUMBER_INT);

        $db = new DBClass();
        $sql = "SELECT news.*,users.realname FROM `news` JOIN users ON news.author = users.id WHERE news.id = $newsitem";

        // Does the newsitem exist? If not, we redirect.

        if ($db->numRows($db->query($sql)) != 1) {
            header('Location: ' . Config::$sys_url . '?page=error');
            die("This newsitem doesnt exist.");
        }
        // It did, yay! - Lets fetch it, and return it.
        return $db->fetchAll($db->query($sql))[0];
    }

    public static function NewsList() {
        // newsadmin
        $db = new DBClass();
        $sql = "SELECT news.*,users.realname FROM `news` JOIN users ON news.author = users.id ORDER BY `id` DESC";
        return $db->fetchAll($db->query($sql));
    }

    public static function publicNewsList() {
        $db = new DBClass();
        $sql = "SELECT news.*,users.realname FROM `news` JOIN users ON news.author = users.id ORDER BY `id` DESC LIMIT 5";
        return $db->fetchAll($db->query($sql));
    }

    /* Event functions */

    public static function ViewEvent($id) {
        /* Here we sanitize the userinput. We only allow numbers here.
         * - Filter the variable to remove anything but numbers (plusses and minusses)
         * However, the filter_var needs us to trim the output first, as we dont want nullbytes.
         */
        $eventitem = filter_var(trim($id), FILTER_SANITIZE_NUMBER_INT);

        // Get the news

        $db = new DBClass();
        $sql = "SELECT * FROM `events` WHERE `id` = $eventitem";
        // Check if this eventitem exists - If not, we 404
        if ($db->numRows($db->query($sql)) != 1) {
            header('Location: ' . Config::$sys_url . '?page=error');
            die("This newsitem doesnt exist.");
        }
        // It did, yay! - Lets fetch it, and return it.
        return $db->fetchAll($db->query($sql))[0];
    }

    public static function EventList() {
        // eventadmin
        $db = new DBClass();
        $sql = "SELECT * FROM `events` ORDER BY `id` DESC";
        return $db->fetchAll($db->query($sql));
    }

    public static function publicEventList() {
        $db = new DBClass();
        $sql = "SELECT * FROM `events` ORDER BY `id` DESC LIMIT 5";
        return $db->fetchAll($db->query($sql));
    }

}