<?

  $bad_words = array ('select', 'insert', 'delete', 'update', 'drop table', 'union', 'null');
  for ($i = 0; $i < sizeof ($_GET); ++$i)
  {
    for ($j = 0; $j < sizeof ($bad_words); ++$j)
    {
      if (preg_match ('/' . $bad_words[$j] . '/', $_GET[key ($_GET)]))
      {
        $temp = key ($_GET);
        $_GET[$temp] = '';
        continue;
      }
    }

    next ($_GET);
  }

  header ('Content-type: application/xml');
  include '../config.inc.php';
  if ($_GET['category'] == 'All')
  {
    if (!($result = mysql_query ('SELECT * FROM articles WHERE status=1 AND type<1 ORDER by tim DESC LIMIT ' . $_GET['amount'])))
    {
      exit ('<b>Error:</b>' . mysql_error ());
      ;
    }
  }
  else
  {
    if (!($result = mysql_query ('' . 'SELECT * FROM articles WHERE instr(category, \'' . $_GET['category'] . '\') AND status=1 AND type<1 ORDER by tim DESC LIMIT ' . $_GET['amount'])))
    {
      exit ('<b>Error:</b>' . mysql_error ());
      ;
    }
  }

  echo '<?xml version="1.0" encoding="' . encoding . '"?>
';
  echo '<rss version="2.0">
<channel>

	<title>';
  echo title;
  echo '</title>
	<link>';
  echo $_SERVER['SERVER_NAME'];
  echo '</link>
	<description>';
  echo description;
  echo '</description>

';
  while ($row = mysql_fetch_array ($result))
  {
    echo '<item>
	<title>';
    echo $row['title'];
    echo '</title>
	<link>http://';
    echo $_SERVER['SERVER_NAME'];
    echo '/index.php?id=';
    echo $row['id'];
    echo '</link>
	<pubDate>';
    echo date ('r', $row['tim']);
    echo '</pubDate>
	<description>';
    echo $row['description'];
    echo '</description>
</item>
';
  }

  echo '	
	
</channel>
</rss>';
?>
