<?php
if (isset($_GET['alt']) && isset($_GET['realm']))
{
	$s_alt = htmlentities($_GET['alt']);
	$s_realm = htmlentities($_GET['realm']);
	echo "<form action=\"wish_new.php?alt=".$s_alt ."&realm=".$s_realm ."\" method=\"post\">"; //sanitise
}
else
{
	echo "<form action=\"wish_new.php\" method=\"post\">";
}
echo "Character:";
echo "<select name=\"altid\">";
$s_session_user_logged = addslashes($_SESSION['user_logged']);
$altquery = "SELECT altid, altname, altrealm FROM alts WHERE owner = '". $s_session_user_logged . "';";
$altresult = mysql_query($altquery) or die(mysql_error());

while ( $row = mysql_fetch_assoc($altresult))
{
	if (isset($_GET['alt']) && isset($_GET['realm']) && // santise
		($_GET['alt'] == $row[altname]) && ($_GET['realm'] == $row[altrealm]))
	{
		echo "<option value=\"" .$row[altid]. "\" selected=\"selected\">" .$row[altname]. " on " .$row[altrealm].  "</option>";
	}
	else
	{
		echo "<option value=\"" .$row[altid]. "\">" .$row[altname]. " on " .$row[altrealm].  "</option>";
	}
}

echo "</select>";
echo "<br />";
		
echo "Dungeon:";
echo "<select name=\"dungeonid\">";

	$dungeonquery = "SELECT dungeonid, dungeonname FROM dungeons;";
	$dungeonresult = mysql_query($dungeonquery) or die(mysql_error());
	
	while ($row = mysql_fetch_assoc($dungeonresult))
	{
		echo "<option value=\"" .$row[dungeonid]. "\">" .$row[dungeonname]. "</option>";
	}

echo "</select>";
echo "<br />";

echo "Heroic: <input type=\"checkbox\" name=\"heroic\" value=\"checked\"><br />";
		
echo "<input type=\"submit\" name=\"submit\" value=\"Wish\"> ";
echo "<input type=\"reset\" value=\"Reset\">";
echo "</form>";
?>