delete_answer.php at EasyFest

<?php
include_once("include/db_connection.php");
	header("Expires: Thu, 17 May 2001 10:17:17 GMT");    // Date in the past
	header ("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); // always modified
	header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
	header ("Pragma: no-cache");                          // HTTP/1.0              
	session_start();
		if($_SESSION["adminloggedIn"] == FALSE){
		header("Location:admin_login.php");
		exit;
	}
$UserName=$_SESSION['UserName'];
//$sql1="SELECT * FROM $tbl_name ORDER BY (id) DESC";
// OREDER BY id DESC is order result by descending
//$result=mysql_query($sq1l);
//$result = MYSQL_QUERY($sql1);
?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252" />
<title>Easy Fest</title>
</head>
<body>
<?php
$id=$_GET['id'];
$a_id=$_GET['a_id'];
$TableName="forum_answer";
$result1 = mysql_fetch_array(mysql_query("SELECT a_name from $TableName WHERE question_id=$id"));
//$query="DELETE from Polls WHERE PollId=$PollId";
$query1=mysql_fetch_array(mysql_query("select UserName FROM users WHERE Type=0"));
if($UserName==$query1[0] || $UserName==$result1['a_name']){
//$query = mysql_query("DELETE FROM forum_question WHERE id=$id");
$sql="SELECT MAX(a_id) AS Maxa_id FROM $TableName WHERE question_id='$id'";
$result=mysql_query($sql);
$rows=mysql_fetch_array($result);
$i=$rows['Maxa_id']-$a_id;
if ($rows) {
     $Max_id = $rows['Maxa_id']-1;
            }
			$tbl_name2="forum_question";
                    $sql3="UPDATE $tbl_name2 SET reply='$Max_id' WHERE id='$id'";
                    $result3=mysql_query($sql3);
					$a_id1=$a_id;
					
$query2= mysql_query("DELETE from $TableName where question_id=$id and a_id=$a_id");
            while($i>0)
					{
					  $a_id1=$a_id1+1;
					  $value=$a_id1-1;
					  $sql4="UPDATE $TableName SET a_id='$value' WHERE question_id='$id' and a_id='$a_id1';";
                      $result4=mysql_query($sql4);
                      $i=$i-1;
					}  

            

//$query2=mysql_query("Drop table $TableName");
//$UserName=$_GET[UserName];
//$query2=mysql_query("Drop table $TableName");*/ 
?>
<script type="text/javascript">
<!--
window.location = "main_forum.php"; 
//-->
</script>	
<?php }
else
{
echo "you are not authorised to delete this poll";
}
?>