user_deletePoll.php at EasyFest

<?php
include_once("include/db_connection.php");
	header("Expires: Thu, 17 May 2001 10:17:17 GMT");    // Date in the past
	header ("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); // always modified
	header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
	header ("Pragma: no-cache");                          // HTTP/1.0              
	session_start();
		if($_SESSION["loggedIn"] == FALSE){
		header("Location:user_login.php");
		exit;
			
	}include_once("config.php");
	
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252" />
<title>Easy Fest</title>
</head>
<body>
<?php
$UserName=$_GET[UserName];
$PollId=$_GET[PollId];
$TableName="Poll"."$PollId";
$result1 = mysql_fetch_array(mysql_query("SELECT UserName from Polls WHERE PollId=$PollId"));
//$query="DELETE from Polls WHERE PollId=$PollId";
$query1=mysql_fetch_array(mysql_query("select UserName FROM users WHERE Type=0"));
if($result1[0]==$UserName ||$UserName==$query1[0]){
$query = mysql_query("DELETE FROM Polls WHERE PollId=$PollId");
$query2=mysql_query("Drop table $TableName");?>
<script type="text/javascript">
<!--
window.location = "user_viewAllPoll.php?PollId=<?php echo  $PollId ;?>"
//-->
</script>	
<?php }
else
{?>
<script type="text/javascript">
window.location="error.php?error=<?php echo "you are not authorised to delete this poll";?>"
</script>

<?php }
?>