include('includes/dbconn-public.php');
include('includes/admin-banner.php');
//error_reporting(E_ALL);
$primaryImageName='image-not-available.png';
$checkTitle=trim($_GET['title']);
$vID=trim($_GET['tag']);
$vID=preg_replace('/[^0-9]/', '', $vID); //need to sanitize this tightly outside DB query too since outputting in HTML for CSS id#'s (to avoid XSS), updated Feb 9 2023
$sql = $db->prepare("select REPLACE(REPLACE(lower(concat(i.year,'-',i.make,'-',i.model)),' ','-'),'+','') as checktitle, i.VIN, i.sold, i.md5val as cmd5val, i.type, i.category as vtype, p.photoname, i.options as optionslist, i.dealerComments as additionaltext, i.color, i.interiorcolor, i.stocknum, i.motor as engine, i.transmission, i.year, i.make, i.model, i.kms, i.oldprice as regprice, i.newprice as saleprice from inventory i left outer join inventory_photos p on p.md5val=i.md5val where i.id=:vid and (p.ismain=1 or p.ismain IS NULL) limit 1");
$sql->bindParam(':vid', $vID, PDO::PARAM_INT, 12);
$sql->execute();
//check if input title is same as vehicle title. if not we redirect.
//die('testing');
if($sql->rowCount()==0)
{
header('Location: /inventory');
exit;
}
$row = $sql->fetch();
if($checkTitle!==$row['checktitle'])
{
//die($checkTitle.'|'.$row['checktitle']);
header('Location: /404.php');
exit;
}
$vstatus=$row['vstatus'];
$vehicleName=$row['year'].' '.$row['make'].' '.$row['model'];
$lastUpdated=$row['lastupdated'];
$cmd5val=$row['cmd5val'];
//if(!empty($row['vtype'])) $vehDetails.='
$sql = $db->prepare("select contesttext from contestinfo where id=1 limit 1");
$result=$sql->execute();
$row=$sql->fetch();
$contestText=$row['contesttext'];
?>
One entry per contest