<?php

include ('header.php');

if(!is_numeric($pid)) {die("Can not access this page");}

$note=htmlspecialchars($note);
$note=mysql_escape_string($note);


if ($op=="add" and $pid<>"") {

	$query="select name from plugins where id=$pid";
	$result=$dbconn->execute($query);
	list($pname)=$result->fields;
	
	echo "New note for '<B>$pname</B>' plugin:<BR><form method=\"post\" action=\"notes.php?op=save&amp;pid=$pid\">
	<TEXTAREA name=\"note\" rows=5 cols=40 ></TEXTAREA>
	<BR><input type=\"submit\" name=\"submit\" value=\"Save\">
	</form>";


}
else if ($op=="save" and $pid<>"") {

	$query = "insert into nessus_notes (username, pid, note) values ('$username', $pid, '$note')";
	$result=$dbconn->execute($query);
	echo "Note saved.
	<a href=\"results.php\">Back to the results page</a>";


}





include ('footer.php');


?>
