playlist_add.php at The cool MP3 database of the future

<?php
# sql safe 2001-11-17 12:26

include("./include/standard.inc.php");
sstart();
if ($user['levela']['playlist_edit']==1) 
{
	if (pvalid())
	{
		if (isset($_GET["albumID"]))
			add_album($_GET["albumID"]);
		elseif (isset($_GET["trackID"]))
			add_track($_GET["trackID"]);
	}
		else
			header("HTTP/1.0 204 No Content");
	
}
else
{
	echo '<html>';
	not_allowed();
	echo '</html>';
}

function add_album($ID)
{
	$ID = (int)$ID;
	
	$query = db_query("SELECT ID FROM track_index WHERE albumID = $ID ORDER BY track");
	list ($num) = mysql_fetch_row(db_query("SELECT MAX(num) FROM playlist_data WHERE playlistID=".$_SESSION["plist_query"]['ID']));
	while (list ($result)=mysql_fetch_row($query))
	{
		$num++;
		db_query("INSERT INTO playlist_data (playlistID, songID, num) VALUES (".$_SESSION["plist_query"]['ID'].", $result, $num )");
		#echo mysql_affected_rows();
	}
	header("HTTP/1.0 204 No Content");
}

function add_track($ID)
{
	$ID = (int)$ID;

	$query = db_query("SELECT ID FROM track_index WHERE albumID = $ID ORDER BY track");
	list ($num) = mysql_fetch_row(db_query("SELECT MAX(num) FROM playlist_data WHERE playlistID=".$_SESSION["plist_query"]['ID']));
	$num++;
	db_query("INSERT INTO playlist_data (playlistID, songID, num) VALUES (".$_SESSION["plist_query"]['ID'].", $ID, $num )");

	header("HTTP/1.0 204 No Content");
}

?>