CVE-2015-2678: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter in the categories page to gxadmin/index.php or (2) page parameter to index.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-03-23T16:59Z
Repository: https://github.com/semplon/GeniXCMS
Language: PHP
Files changed: gxadmin/inc/categories.php, gxadmin/inc/menus.php, gxadmin/inc/menus_form.php, gxadmin/inc/menus_form_edit.php, gxadmin/inc/pages.php, gxadmin/inc/pages_form.php, gxadmin/inc/posts.php, gxadmin/inc/posts_form.php, gxadmin/inc/settings.php, gxadmin/inc/user.php, gxadmin/inc/user_form.php, inc/lib/Categories.class.php, inc/lib/Control.class.php, inc/lib/Control/Backend/categories.control.php, inc/lib/Control/Backend/menus.control.php, inc/lib/Control/Backend/pages.control.php, inc/lib/Control/Backend/posts.control.php, inc/lib/Control/Backend/settings.control.php, inc/lib/Control/Backend/users.control.php, inc/lib/Control/Error/db.control.php, inc/lib/Control/Error/unknown.control.php, inc/lib/Control/Frontend/cat.control.php, inc/lib/Control/Frontend/default.control.php, inc/lib/Control/Frontend/page.control.php, inc/lib/Control/Frontend/post.control.php, inc/lib/Control/Install/default.control.php, inc/lib/Db.class.php, inc/lib/GxMain.class.php, inc/lib/Install.class.php, inc/lib/Mail.class.php, inc/lib/Menus.class.php, inc/lib/Options.class.php, inc/lib/Posts.class.php, inc/lib/Rss.class.php, inc/lib/Site.class.php, inc/lib/System.class.php, inc/lib/Token.class.php, inc/lib/Upload.class.php, inc/lib/Url.class.php
Commit date: 2015-03-10 08:55:02 +0700
Commit message: Security FIX, Bug FIX

Diff: diff --git a/gxadmin/inc/categories.php b/gxadmin/inc/categories.php
index 4f12fd0..b520411 100644
--- a/gxadmin/inc/categories.php
+++ b/gxadmin/inc/categories.php
@@ -10,11 +10,39 @@
 * @link https://github.com/semplon/GeniXCMS
 * @author Puguh Wijayanto (www.metalgenix.com)
 * @copyright 2014-2015 Puguh Wijayanto
 * @license http://www.opensource.org/licenses/mit-license.php MIT
 *
-*/?>
+*/
+
+if (isset($data['alertgreen'])) {
+    # code...
+    echo "<div class=\"alert alert-success\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>";
+    foreach ($data['alertgreen'] as $alert) {
+        # code...
+        echo "$alert\n";
+    }
+    echo "</div>";
+}
+if (isset($data['alertred'])) {
+    # code...
+    echo "<div class=\"alert alert-danger\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>";
+    foreach ($data['alertred'] as $alert) {
+        # code...
+        echo "$alert\n";
+    }
+    echo "</div>";
+}
+?>
 <div class="row">
     <div class="col-md-12">
         <h1><i class="fa fa-cubes"></i>  Categories 
             <button class="btn btn-success pull-right" data-toggle="modal" data-target="#myModal">
                 <span class="glyphicon glyphicon-plus"></span> Add Category
@@ -32,31 +60,32 @@
                         // echo "<td>".$c->id."</td>";
                         // echo "<td>".$c->name."</td>";
                         // echo "<td>".$c->parent."</td>";
                         // echo "<td></td>";
 
-                        if($c->parent == ""){
+                        if($c->parent == "" || $c->parent == 0){
                             echo "<div class=\"col-md-4 item\" >
                             <div class=\"panel panel-default\">
                                 <div class=\"panel-heading\">
                                   <h3 class=\"panel-title\">{$c->name} 
-                                  <a href=\"?page=categories&act=del&id={$c->id}\" class=\"pull-right\"
+                                  <a href=\"?page=categories&act=del&id={$c->id}&token=".TOKEN."\" class=\"pull-right\"
                                   onclick=\"return confirm('Are you sure you want to delete this item?');\">
                                   <span class=\"glyphicon glyphicon-remove\"></span></a></h3>
                                 </div>
                                 <div class=\"panel-body\">
                                 <ul class=\"list-group\">";
                                 foreach ($data['cat'] as $c2) {
                                     if($c2->parent == $c->id){
                                         echo "<li class=\"list-group-item\">
-                                        <form action=\"\" method=\"POST\" name=\"updatecat\">
+                                        <form action=\"index.php?page=categories\" method=\"POST\" name=\"updatecat\">
                                         <div class=\"input-group\">
-                                            <a href=\"?page=categories&act=del&id={$c2->id}\" class=\"input-group-addon\"
+                                            <a href=\"?page=categories&act=del&id={$c2->id}&token=".TOKEN."\" class=\"input-group-addon\"
                                             onclick=\"return confirm('Are you sure you want to delete this item?');\"
                                             ><span class=\"glyphicon glyphicon-remove\"></span></a>
                                             <input type=\"text\" name=\"cat\" class=\"form-control\" value=\"{$c2->name}\">
                                             <input type=\"hidden\" name=\"id\" value=\"{$c2->id}\">
+                                            <input type=\"hidden\" name=\"token\" value=\"".TOKEN."\">
                                             <span class=\"input-group-btn\">
                                                 <button class=\"btn btn-default\" type=\"submit\" name=\"updatecat\">Go!</button>
                                             </span>
                                         </div>
                                         </form>
@@ -90,11 +119,11 @@
             
                 <div class="form-group">
                     <label>Parent</label>
                     <?php
                         $vars = array(
-                                    'parent' => '',
+                                    'parent' => '0',
                                     'name' => 'parent',
                                     'sort' => 'ASC',
                                     'order_by' => 'name'
                                 );
                         echo Categories::dropdown($vars);
@@ -105,10 +134,11 @@
                     <input type="text" name="cat" class="form-control">
                 </div>
             
           </div>
           <div class="modal-footer">
+            <input type="hidden" name="token" value="<?=TOKEN;?>">
             <button type="button" class="btn btn-default" data-dismiss="modal">Close</button>
             <button type="submit" class="btn btn-success" name="addcat">Save changes</button>
           </div>
           </form>
         </div><!-- /.modal-content -->
diff --git a/gxadmin/inc/menus.php b/gxadmin/inc/menus.php
index 0339104..e79aac0 100644
--- a/gxadmin/inc/menus.php
+++ b/gxadmin/inc/menus.php
@@ -10,11 +10,41 @@
 * @link https://github.com/semplon/GeniXCMS
 * @author Puguh Wijayanto (www.metalgenix.com)
 * @copyright 2014-2015 Puguh Wijayanto
 * @license http://www.opensource.org/licenses/mit-license.php MIT
 *
-*/?>
+*/
+
+if (isset($data['alertgreen'])) {
+    # code...
+    echo "<div class=\"alert alert-success\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>
+    <ul>";
+    foreach ($data['alertgreen'] as $alert) {
+        # code...
+        echo "<li>$alert</li>\n";
+    }
+    echo "</ul></div>";
+}elseif (isset($data['alertred'])) {
+    # code...
+    //print_r($data['alertred']);
+    echo "<div class=\"alert alert-danger\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>
+    <ul>";
+    foreach ($data['alertred'] as $alert) {
+        # code...
+        echo "<li>$alert</li>\n";
+    }
+    echo "</ul></div>";
+}
+?>
 <div class="row">
     <div class="col-md-12">
 
         <h1><i class="fa fa-sitemap"></i> Menus
             <div class="pull-right">
@@ -82,11 +112,11 @@
                             echo "
                                               </div>
                                           </div>
                                           <div class=\"tab-pane\" id=\"{$k}additem\">
                                           ";
-                                              $data['parent'] = Menus::getParent('', $k);
+                                              $data['parent'] = Menus::isHadParent('', $k);
                                               //print_r($data['parent']);
                                               $data['menuid'] = $k;
                                               System::inc('menus_form', $data);
                             echo "
                                           </div>
@@ -144,10 +174,11 @@
                     </div>
                 </div>
 
           </div>
           <div class="modal-footer">
+            <input type="hidden" name="token" value="<?=TOKEN;?>">
             <button type="button" class="btn btn-default" data-dismiss="modal">Close</button>
             <button type="submit" class="btn btn-success" name="submit">Save changes</button>
           </div>
           </form>
         </div><!-- /.modal-content -->
diff --git a/gxadmin/inc/menus_form.php b/gxadmin/inc/menus_form.php
index 970a1dc..d2db913 100644
--- a/gxadmin/inc/menus_form.php
+++ b/gxadmin/inc/menus_form.php
@@ -17,10 +17,39 @@
     if(isset($_GET['id'])){
         $menuid = $_GET['id'];
     }else{
         $menuid = $data['menuid'];
     }
+if (isset($data['alertgreen'])) {
+    # code...
+    echo "<div class=\"alert alert-success\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>
+    <ul>";
+    foreach ($data['alertgreen'] as $alert) {
+        # code...
+        echo "<li>$alert</li>\n";
+    }
+    echo "</ul></div>";
+}elseif (isset($data['alertred'])) {
+    # code...
+    //print_r($data['alertred']);
+    echo "<div class=\"alert alert-danger\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>
+    <ul>";
+    foreach ($data['alertred'] as $alert) {
+        # code...
+        echo "<li>$alert</li>\n";
+    }
+    echo "</ul></div>";
+}
+
 ?>
 <form action="" method="POST">
 <h1><i class="fa fa-sitemap"></i> Add Menu
 <div class="pull-right">
 <button type="submit" name="additem" class="btn btn-success">
@@ -140,6 +169,7 @@
                 <small>Choose This if you want menu with Custom Link Categories. Insert Custom Link</small>
             </div>
         </div>
     </div>
 </div>
+<input type="hidden" name="token" value="<?=TOKEN;?>">
 </form>
\ No newline at end of file
diff --git a/gxadmin/inc/menus_form_edit.php b/gxadmin/inc/menus_form_edit.php
index 8c4ddcb..d2a6716 100644
--- a/gxadmin/inc/menus_form_edit.php
+++ b/gxadmin/inc/menus_form_edit.php
@@ -19,16 +19,38 @@
     }else{
         $menuid = $data['menuid'];
     }
 
     //print_r($data['menus']);
-    if(isset($data['alertgreen']) ) {
-        echo "<div class=\"alert alert-success\">";
-            foreach ($data['alertgreen'] as $alert) {
-                echo "$alert"; 
-            }
-        echo "</div>"; }
+    if (isset($data['alertgreen'])) {
+    # code...
+    echo "<div class=\"alert alert-success\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>
+    <ul>";
+    foreach ($data['alertgreen'] as $alert) {
+        # code...
+        echo "<li>$alert</li>\n";
+    }
+    echo "</ul></div>";
+}elseif (isset($data['alertred'])) {
+    # code...
+    //print_r($data['alertred']);
+    echo "<div class=\"alert alert-danger\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>
+    <ul>";
+    foreach ($data['alertred'] as $alert) {
+        # code...
+        echo "<li>$alert</li>\n";
+    }
+    echo "</ul></div>";
+}
 ?>
 <form action="" method="POST">
 <div class="row">
     <div class="col-md-12">
 <h1><i class="fa fa-sitemap"></i> Edit Menu
@@ -46,15 +68,16 @@
 </div>
 <div class="col-sm-12">
     <div class="col-sm-4">
         <div class="form-group">
             <label>Parent Menu</label>
+            
             <select class="form-control" name="parent">
                 <option></option>
             <?php
                //echo($data['abc']);
-                //print_r($data['parent']);
+                //print_r($data['menus']);
                 foreach ($data['parent'] as $p) {
                     # code...
                     if($data['menus'][0]->parent == $p->id){
                         $sel = 'SELECTED';
                     }else{
@@ -181,7 +204,8 @@
                 <small>Choose This if you want menu with Custom Link Categories. Insert Custom Link</small>
             </div>
         </div>
     </div>
 </div>
+<input type="hidden" name="token" value="<?=$_GET['token'];?>">
 </form>
 </div>
\ No newline at end of file
diff --git a/gxadmin/inc/pages.php b/gxadmin/inc/pages.php
index 36fde2a..82319cb 100644
--- a/gxadmin/inc/pages.php
+++ b/gxadmin/inc/pages.php
@@ -11,103 +11,115 @@
 * @author Puguh Wijayanto (www.metalgenix.com)
 * @copyright 2014-2015 Puguh Wijayanto
 * @license http://www.opensource.org/licenses/mit-license.php MIT
 *
 */
-    if (isset($data['alertgreen'])) {
+if (isset($data['alertgreen'])) {
+    # code...
+    echo "<div class=\"alert alert-success\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>";
+    foreach ($data['alertgreen'] as $alert) {
         # code...
-        echo "<div class=\"alert alert-success\" >
-        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
-            <span aria-hidden=\"true\">&times;</span>
-            <span class=\"sr-only\">Close</span>
-        </button>";
-        foreach ($data['alertgreen'] as $alert) {
-            # code...
-            echo "$alert\n";
-        }
-        echo "</div>";
+        echo "$alert\n";
     }
-    if (isset($data['alertred'])) {
+    echo "</div>";
+}
+if (isset($data['alertred'])) {
+    # code...
+    echo "<div class=\"alert alert-danger\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>";
+    foreach ($data['alertred'] as $alert) {
         # code...
-        echo "<div class=\"alert alert-danger\" >
-        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
-            <span aria-hidden=\"true\">&times;</span>
-            <span class=\"sr-only\">Close</span>
-        </button>";
-        foreach ($data['alertred'] as $alert) {
-            # code...
-            echo "$alert\n";
-        }
-        echo "</div>";
+        echo "$alert\n";
     }
+    echo "</div>";
+}
 ?>
 <div class="row">
     <div class="col-md-12">
         <h1><i class="fa fa-file-o"></i> Pages <a href="index.php?page=pages&act=add" class="btn btn-primary pull-right">Add New</a></h1>
         <hr />
     </div>
     <div class="col-md-12">
-        <div class="table-responsive">
-            <table class="table table-hover">
-                <thead>
-                    <tr>
-                        <th>ID</th>
-                        <th>Title</th>
-                        <th>Date</th>
-                        <th>Edit/Delete</th>
-                        <th>All <input type="checkbox" id="selectall"></th>
-                    </tr>
-                </thead>
-                <tbody>
-                    <?php
-                        //print_r($data);
-                    if($data['num'] > 0){
-                        foreach ($data['posts'] as $p) {
-                            # code...
-                            //echo $p->id;
+        <form action="" method="post">
+            <div class="table-responsive">
+                <table class="table table-hover">
+                    <thead>
+                        <tr>
+                            <th>ID</th>
+                            <th>Title</th>
+                            <th>Date</th>
+                            <th>Status</th>
+                            <th>Edit/Delete</th>
+                            <th>All <input type="checkbox" id="selectall"></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        <?php
+                            //print_r($data);
+                        if($data['num'] > 0){
+                            foreach ($data['posts'] as $p) {
+                                # code...
+                                //echo $p->id;
+                                if($p->status == '0'){
+                                    $status = "UnPublished";
+                                }else{
+                                    $status = "Published";
+                                }
+                                echo "
+                                <tr>
+                                    <td>{$p->id}</td>
+                                    <td><a href=\"".Url::page($p->id)."\" target=\"_new\">{$p->title}</a></td>
+                                    <td>{$p->date}</td>
+                                    <td>{$status}</td>
+                                    <td>
+                                        <a href=\"index.php?page=pages&act=edit&id={$p->id}&token=".TOKEN."\" class=\"label label-success\">Edit</a> 
+                                        <a href=\"index.php?page=pages&act=del&id={$p->id}&token=".TOKEN."\" class=\"label label-danger\" 
+                                        onclick=\"return confirm('Are you sure you want to delete this item?');\">Delete</a>
+                                    </td>
+                                        <td>
+                                        <input type=\"checkbox\" name=\"post_id[]\" value=\"{$p->id}\" id=\"select\">
+                                    </td>
+                                </tr>
+                                ";
+                            }
+                        }else{
                             echo "
-                            <tr>
-                                <td>{$p->id}</td>
-                                <td><a href=\"".Url::page($p->id)."\" target=\"_new\">{$p->title}</a></td>
-                                <td>{$p->date}</td>
-                                <td>
-                                    <a href=\"index.php?page=pages&act=edit&id={$p->id}\" class=\"label label-success\">Edit</a> 
-                                    <a href=\"index.php?page=pages&act=del&id={$p->id}\" class=\"label label-danger\" 
-                                    onclick=\"return confirm('Are you sure you want to delete this item?');\">Delete</a>
-                                </td>
+                                <tr>
                                     <td>
-                                    <input type=\"checkbox\" name=\"post_id[]\" value=\"{$p->id}\" id=\"select\">
-                                </td>
-                            </tr>
-                            ";
+                                        No Pages Found 
+                                    </td>
+                                </tr>";
                         }
-                    }else{
-                        echo "
-                            <tr>
-                                <td>
-                                    No Pages Found 
-                                </td>
-                            </tr>";
-                    }
-                    ?>
-                </tbody>
-                <tfoot>
-                    <th>ID</th>
-                    <th>Title</th>
-                    <th>Date</th>
-                    <th>
-                    <select name="action" class="form-control">
-                        <option value="publish">Publish</option>
-                        <option value="unpublish">UnPublish</option>
-                        <option value="delete">Delete</option>
-                    </select>
-                    </th>
-                    <th>
-                        <button type="submit" name="doaction" class="btn btn-danger">
-                            Submit
-                        </button>
-                    </th>
-                </tfoot>
-            </table>
-        </div>
+                        ?>
+                    </tbody>
+                    <tfoot>
+                        <th>ID</th>
+                        <th>Title</th>
+                        <th>Date</th>
+                        <th>Status</th>
+                        <th>
+                        <select name="action" class="form-control">
+                            <option value="publish">Publish</option>
+                            <option value="unpublish">UnPublish</option>
+                            <option value="delete">Delete</option>
+                        </select>
+                        <input type="hidden" name="token" value="<?=TOKEN;?>">
+                        </th>
+                        <th>
+                            <button type="submit" name="doaction" class="btn btn-danger">
+                                Submit
+                            </button>
+                        </th>
+                    </tfoot>
+                </table>
+            </div>
+        </form>
+        
     </div>
 </div>
\ No newline at end of file
diff --git a/gxadmin/inc/pages_form.php b/gxadmin/inc/pages_form.php
index 75b649b..c07949f 100644
--- a/gxadmin/inc/pages_form.php
+++ b/gxadmin/inc/pages_form.php
@@ -11,24 +11,43 @@
 * @author Puguh Wijayanto (www.metalgenix.com)
 * @copyright 2014-2015 Puguh Wijayanto
 * @license http://www.opensource.org/licenses/mit-license.php MIT
 *
 */
-    if (isset($data['alertgreen'])) {
+
+isset($_GET['token'])? $token = $_GET['token']: $token = TOKEN;
+($_GET['act'] == "edit")? $pagetitle = "Edit": $pagetitle = "New";
+($_GET['act'] == "edit")? $act = "edit&id={$_GET['id']}&token={$_GET['token']}": $act = "add";
+
+if (isset($data['alertgreen'])) {
+    # code...
+    echo "<div class=\"alert alert-success\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>
+    ";
+    foreach ($data['alertgreen'] as $alert) {
         # code...
-        echo "<div class=\"alert alert-success\" >
-        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
-            <span aria-hidden=\"true\">&times;</span>
-            <span class=\"sr-only\">Close</span>
-        </button>
-        ";
-        foreach ($data['alertgreen'] as $alert) {
-            # code...
-            echo "$alert\n";
-        }
-        echo "</div>";
+        echo "$alert\n";
+    }
+    echo "</div>";
+}
+
+if (isset($data['alertred'])) {
+    # code...
+    echo "<div class=\"alert alert-danger\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>";
+    foreach ($data['alertred'] as $alert) {
+        # code...
+        echo "$alert\n";
     }
+    echo "</div>";
+}
 
     if(isset($data['post'])) {
         foreach ($data['post'] as $p) {
             # code...
             $title = $p->title;
@@ -52,11 +71,11 @@
         $cat = "";
         $pub = "";
         $unpub = "";
     }
 ?>
-<form action="" method="post" role="form" class="">
+<form action="index.php?page=pages&act=<?=$act?>" method="post" role="form" class="">
 <div class="row">
     <div class="col-md-12">
         <h1><i class="fa fa-file-o"></i> New Page 
             <div class="pull-right">
                 <button type="submit" name="submit" class="btn btn-success">
@@ -112,7 +131,8 @@
             
         </div>
         
     </div>
 </div>
+<input type="hidden" name="token" value="<?=$token;?>">
 </form>
 
diff --git a/gxadmin/inc/posts.php b/gxadmin/inc/posts.php
index 51287dc..a3d29e0 100644
--- a/gxadmin/inc/posts.php
+++ b/gxadmin/inc/posts.php
@@ -53,10 +53,11 @@
             <tr>
                 <th>ID</th>
                 <th>Title</th>
                 <th>Category</th>
                 <th>Date</th>
+                <th>Status</th>
                 <th>Edit/Delete</th>
                 <th>All <input type="checkbox" id="selectall"></th>
             </tr>
         </thead>
         <tbody>
@@ -64,19 +65,25 @@
                 //print_r($data);
                 if($data['num'] > 0){
                     foreach ($data['posts'] as $p) {
                         # code...
                         //echo $p->id;
+                        if($p->status == '0'){
+                            $status = "UnPublished";
+                        }else{
+                            $status = "Published";
+                        }
                         echo "
                         <tr>
                             <td>{$p->id}</td>
                             <td><a href=\"".Url::post($p->id)."\" target=\"_new\">{$p->title}</a></td>
                             <td>".Categories::name($p->cat)."</td>
                             <td>{$p->date}</td>
+                            <td>{$status}</td>
                             <td>
-                                <a href=\"index.php?page=posts&act=edit&id={$p->id}\" class=\"label label-success\">Edit</a> 
-                                <a href=\"index.php?page=posts&act=del&id={$p->id}\" class=\"label label-danger\" 
+                                <a href=\"index.php?page=posts&act=edit&id={$p->id}&token=".TOKEN."\" class=\"label label-success\">Edit</a> 
+                                <a href=\"index.php?page=posts&act=del&id={$p->id}&token=".TOKEN."\" class=\"label label-danger\" 
                                 onclick=\"return confirm('Are you sure you want to delete this item?');\">Delete</a>
                             </td>
                             <td>
                                 <input type=\"checkbox\" name=\"post_id[]\" value=\"{$p->id}\" id=\"select\">
                             </td>
@@ -96,16 +103,18 @@
         <tfoot>
             <th>ID</th>
             <th>Title</th>
             <th>Category</th>
             <th>Date</th>
+            <th>Status</th>
             <th>
             <select name="action" class="form-control">
                 <option value="publish">Publish</option>
                 <option value="unpublish">UnPublish</option>
                 <option value="delete">Delete</option>
             </select>
+            <input type="hidden" name="token" value="<?=TOKEN;?>">
             </th>
             <th>
                 <button type="submit" name="doaction" class="btn btn-danger">
                     Submit
                 </button>
diff --git a/gxadmin/inc/posts_form.php b/gxadmin/inc/posts_form.php
index b8a7e31..c02f862 100644
--- a/gxadmin/inc/posts_form.php
+++ b/gxadmin/inc/posts_form.php
@@ -11,67 +11,70 @@
 * @author Puguh Wijayanto (www.metalgenix.com)
 * @copyright 2014-2015 Puguh Wijayanto
 * @license http://www.opensource.org/licenses/mit-license.php MIT
 *
 */
-    if (isset($data['alertgreen'])) {
+isset($_GET['token'])? $token = $_GET['token']: $token = TOKEN;
+($_GET['act'] == "edit")? $pagetitle = "Edit": $pagetitle = "New";
+($_GET['act'] == "edit")? $act = "edit&id={$_GET['id']}&token={$_GET['token']}": $act = "add";
+if (isset($data['alertgreen'])) {
+    # code...
+    echo "<div class=\"alert alert-success\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>";
+    foreach ($data['alertgreen'] as $alert) {
         # code...
-        echo "<div class=\"alert alert-success\" >
-        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
-            <span aria-hidden=\"true\">&times;</span>
-            <span class=\"sr-only\">Close</span>
-        </button>";
-        foreach ($data['alertgreen'] as $alert) {
-            # code...
-            echo "$alert\n";
-        }
-        echo "</div>";
+        echo "$alert\n";
     }
-    if (isset($data['alertred'])) {
+    echo "</div>";
+}
+if (isset($data['alertred'])) {
+    # code...
+    echo "<div class=\"alert alert-danger\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>";
+    foreach ($data['alertred'] as $alert) {
         # code...
-        echo "<div class=\"alert alert-danger\" >
-        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
-            <span aria-hidden=\"true\">&times;</span>
-            <span class=\"sr-only\">Close</span>
-        </button>";
-        foreach ($data['alertred'] as $alert) {
-            # code...
-            echo "$alert\n";
-        }
-        echo "</div>";
+        echo "$alert\n";
     }
+    echo "</div>";
+}
 
-    if(isset($data['post'])) {
-        foreach ($data['post'] as $p) {
-            # code...
-            $title = $p->title;
-            $content = $p->content;
-            $date = $p->date;
-            $status = $p->status;
-            $cat = $p->cat;
-        }
-        if($status == 1) {
-            $pub = "SELECTED"; 
-            $unpub = ""; 
-        }elseif ($status == 0) {
-            $pub = ""; 
-            $unpub = "SELECTED";
-        }
-    }else{
-        $title = "";
-        $content = "";
-        $date = "";
-        $status = "";
-        $cat = "";
-        $pub = "";
-        $unpub = "";
+if(isset($data['post'])) {
+    foreach ($data['post'] as $p) {
+        # code...
+        $title = $p->title;
+        $content = $p->content;
+        $date = $p->date;
+        $status = $p->status;
+        $cat = $p->cat;
+    }
+    if($status == 1) {
+        $pub = "SELECTED"; 
+        $unpub = ""; 
+    }elseif ($status == 0) {
+        $pub = ""; 
+        $unpub = "SELECTED";
     }
+}else{
+    $title = "";
+    $content = "";
+    $date = "";
+    $status = "";
+    $cat = "";
+    $pub = "";
+    $unpub = "";
+}
 ?>
-<form action="" method="post" role="form" class="">
+<form action="index.php?page=posts&act=<?=$act?>" method="post" role="form" class="">
 <div class="row">
     <div class="col-md-12">
-        <h1><i class="fa fa-file-text-o"></i> New Post
+        <h1><i class="fa fa-file-text-o"></i> <?=$pagetitle;?> Post
             <div class="pull-right">
                 <button type="submit" name="submit" class="btn btn-success">
                     <span class="glyphicon glyphicon-ok"></span>
                     Publish
                 </button>
@@ -139,7 +142,8 @@
             
         </div>
         
     </div>
 </div>
+<input type="hidden" name="token" value="<?=$token;?>">
 </form>
 
diff --git a/gxadmin/inc/settings.php b/gxadmin/inc/settings.php
index 1310439..2d5362f 100644
--- a/gxadmin/inc/settings.php
+++ b/gxadmin/inc/settings.php
@@ -10,11 +10,42 @@
 * @link https://github.com/semplon/GeniXCMS
 * @author Puguh Wijayanto (www.metalgenix.com)
 * @copyright 2014-2015 Puguh Wijayanto
 * @license http://www.opensource.org/licenses/mit-license.php MIT
 *
-*/?>
+*/
+
+if (isset($data['alertgreen'])) {
+    # code...
+    echo "<div class=\"alert alert-success\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>
+    ";
+    foreach ($data['alertgreen'] as $alert) {
+        # code...
+        echo "$alert\n";
+    }
+    echo "</div>";
+}
+
+if (isset($data['alertred'])) {
+    # code...
+    echo "<div class=\"alert alert-danger\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>";
+    foreach ($data['alertred'] as $alert) {
+        # code...
+        echo "$alert\n";
+    }
+    echo "</div>";
+}
+
+?>
 <form action="" method="POST" enctype="multipart/form-data">
 <div class="row">
     <div class="col-md-12">
         <h1 class="clearfix"><i class="fa fa-wrench"></i> Settings Page
           <div class="pull-right">
@@ -48,11 +79,11 @@
               <h3>Website Details</h3>
               <div class="col-sm-12">
                   <div class="row">
                       <div class="col-sm-6 form-group">
                           <label>Website Name</label>
-                          <input type="text" name="sitename" value="<?=Options::get('sitename');?>" class="form-control">
+                          <input type="text" name="sitename" value="<?=Site::$name;?>" class="form-control">
                           <small>Your Website Name, Title</small>
                       </div>
                       <div class="col-sm-6 form-group">
                           <label>Website Slogan</label>
                           <input type="text" name="siteslogan" value="<?=Options::get('siteslogan');?>" class="form-control">
@@ -64,32 +95,32 @@
 
               <div class="col-sm-12">
                   <div class="row">
                       <div class="col-sm-6 form-group">
                           <label>Website Domain</label>
-                          <input type="text" name="sitedomain" value="<?=Options::get('sitedomain');?>" class="form-control">
+                          <input type="text" name="sitedomain" value="<?=Site::$domain;?>" class="form-control">
                           <small>Your Domain, eg: example.org</small>
                       </div>
                       <div class="col-sm-6 form-group">
                           <label>Website URL</label>
-                          <input type="text" name="siteurl" value="<?=Options::get('siteurl');?>" class="form-control">
+                          <input type="text" name="siteurl" value="<?=Site::$url;?>" class="form-control">
                           <small>Your Website URL, eg: http://www.example.org</small>
                       </div>
                   </div>
                   
               </div>
 
               <div class="col-sm-12">
                   <div class="row">
                       <div class="col-sm-6 form-group">
                           <label>Website Keywords</label>
-                          <input type="text" name="sitekeywords" value="<?=Options::get('sitekeywords');?>" class="form-control">
+                          <input type="text" name="sitekeywords" value="<?=Site::$key;?>" class="form-control">
                           <small>Your Website Keywords, type your website main keywords.</small>
                       </div>
                       <div class="col-sm-6 form-group">
                           <label>Website Description</label>
-                          <textarea  name="sitedesc" class="form-control"><?=Options::get('sitedesc');?></textarea>
+                          <textarea  name="sitedesc" class="form-control"><?=Site::$desc;?></textarea>
                           <small>Your Website Description, describe your website.</small>
                       </div>
                   </div>
                   
               </div>
@@ -222,11 +253,11 @@
                               $logourl = Options::get('logourl');
                               $logo = Options::get('logo');
                               if($is_logourl == 'on' && $logourl != ''){
                                 $logoimg = "<img src=\"".Options::get('logourl')."\" class=\"clearfix\">";
                               }elseif($is_logourl == 'off' && $logo != ''){
-                                $logoimg = "<img src=\"".Options::get('siteurl').Options::get('logo')."\" class=\"clearfix\">";
+                                $logoimg = "<img src=\"".Site::$url.Options::get('logo')."\" class=\"clearfix\">";
                               }else{
                                 $logoimg = '';
                               }
                           ?>
                           <div class="col-sm-12 clearfix">
@@ -560,10 +591,11 @@
         
 
 
     </div>
 </div>
+<input type="hidden" name="token" value="<?=TOKEN;?>">
 </form>
 <script>
 $('#myTab a').click(function (e) {
   e.preventDefault()
   $(this).tab('show')
diff --git a/gxadmin/inc/user.php b/gxadmin/inc/user.php
index 670826e..55136af 100644
--- a/gxadmin/inc/user.php
+++ b/gxadmin/inc/user.php
@@ -73,13 +73,13 @@
                     <tr>
                         <td>{$p->id}</td>
                         <td>{$p->userid}</td>
                         <td>{$p->email}</td>
                         <td>
-                            <a href=\"index.php?page=users&act=edit&id={$p->id}\" class=\"label label-success\">Edit</a> 
-                            <a href=\"index.php?page=users&act=del&id={$p->id}\" class=\"label label-danger\" 
-                            onclick=\"return confirm('Are you sure you want to delete this item?');\">Delete</a>
+                            <a href=\"index.php?page=users&act=edit&id={$p->id}&token=".TOKEN."\" class=\"label label-success\">Edit</a> 
+                            <a href=\"index.php?page=users&act=del&id={$p->id}&token=".TOKEN."\" class=\"label label-danger\" 
+                            onclick=\"return confirm('Are you sure you want to delete this?');\">Delete</a>
                         </td>
                     </tr>
                     ";
                 }
             }
@@ -112,11 +112,11 @@
                     <label>Retype Password</label>
                     <input type="password" name="pass2" class="form-control">
                 </div>
                 <div class="form-group">
                     <label>E-Mail</label>
-                    <input type="password" name="email" class="form-control">
+                    <input type="email" name="email" class="form-control">
                 </div>
                 <div class="form-group">
                     <label>Group Level</label>
                     <select name="group" class="form-control">
                         <option value="0">Administrator</option>
@@ -127,9 +127,10 @@
           </div>
           <div class="modal-footer">
             <button type="button" class="btn btn-default" data-dismiss="modal">Close</button>
             <button type="submit" class="btn btn-success" name="adduser">Save changes</button>
           </div>
+          <input type="hidden" name="token" value="<?=TOKEN;?>">
           </form>
         </div><!-- /.modal-content -->
       </div><!-- /.modal-dialog -->
     </div><!-- /.modal -->
\ No newline at end of file
diff --git a/gxadmin/inc/user_form.php b/gxadmin/inc/user_form.php
index 0b6b753..b692e1e 100644
--- a/gxadmin/inc/user_form.php
+++ b/gxadmin/inc/user_form.php
@@ -11,38 +11,38 @@
 * @author Puguh Wijayanto (www.metalgenix.com)
 * @copyright 2014-2015 Puguh Wijayanto
 * @license http://www.opensource.org/licenses/mit-license.php MIT
 *
 */
-    if (isset($data['alertgreen'])) {
+if (isset($data['alertgreen'])) {
+    # code...
+    echo "<div class=\"alert alert-success\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>
+    <ul>";
+    foreach ($data['alertgreen'] as $alert) {
         # code...
-        echo "<div class=\"alert alert-success\" >
-        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
-            <span aria-hidden=\"true\">&times;</span>
-            <span class=\"sr-only\">Close</span>
-        </button>
-        <ul>";
-        foreach ($data['alertgreen'] as $alert) {
-            # code...
-            echo "<li>$alert</li>\n";
-        }
-        echo "</ul></div>";
-    }elseif (isset($data['alertred'])) {
+        echo "<li>$alert</li>\n";
+    }
+    echo "</ul></div>";
+}elseif (isset($data['alertred'])) {
+    # code...
+    //print_r($data['alertred']);
+    echo "<div class=\"alert alert-danger\" >
+    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
+        <span aria-hidden=\"true\">&times;</span>
+        <span class=\"sr-only\">Close</span>
+    </button>
+    <ul>";
+    foreach ($data['alertred'] as $alert) {
         # code...
-        //print_r($data['alertred']);
-        echo "<div class=\"alert alert-danger\" >
-        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
-            <span aria-hidden=\"true\">&times;</span>
-            <span class=\"sr-only\">Close</span>
-        </button>
-        <ul>";
-        foreach ($data['alertred'] as $alert) {
-            # code...
-            echo "<li>$alert</li>\n";
-        }
-        echo "</ul></div>";
+        echo "<li>$alert</li>\n";
     }
+    echo "</ul></div>";
+}
 ?>
 <form action="" method="post">
 <div class="row">
     <div class="col-md-12">
         <h1><i class="fa fa-group"></i> Edit User 
@@ -107,6 +107,7 @@
         
 
     </div>
     </div>
 </div>
+<input type="hidden" name="token" value="<?=$_GET['token'];?>">
 </form>
diff --git a/inc/lib/Categories.class.php b/inc/lib/Categories.class.php
index 6ae6fd4..2e67524 100644
--- a/inc/lib/Categories.class.php
+++ b/inc/lib/Categories.class.php
@@ -66,18 +66,21 @@ class Categories
             }else{
                 $order_by .= " `name` ";
             }
             if (isset($vars['sort'])) {
                 $sort = " {$vars['sort']}";
+            }else{
+                $sort = " ASC";
             }
         }
         $cat = Db::result("SELECT * FROM `cat` {$where} {$order_by} {$sort}");
+        //print_r($cat);
         $drop = "<select name=\"{$name}\" class=\"form-control\"><option></option>";
         if(Db::$num_rows > 0 ){
             foreach ($cat as $c) {
                 # code...
-                if($c->parent == ''){
+                if($c->parent == null || $c->parent == '0' ){
                     if(isset($vars['selected']) && $c->id == $vars['selected']) $sel = "SELECTED"; else $sel = "";
                     $drop .= "<option value=\"{$c->id}\" $sel style=\"padding-left: 10px;\">{$c->name}</option>";
                     foreach ($cat as $c2) {
                         # code...
                         if($c2->parent == $c->id){
diff --git a/inc/lib/Control.class.php b/inc/lib/Control.class.php
index 78b39dd..ae1ff49 100644
--- a/inc/lib/Control.class.php
+++ b/inc/lib/Control.class.php
@@ -143,15 +143,15 @@ class Control
     * @param string $vars
     *
     * @author Puguh Wijayanto (www.metalgenix.com)
     * @since 0.0.1 
     */
-    public static function error ($vars="") {
+    public static function error ($vars="", $val='') {
         if( isset($vars) && $vars != "" ) {
             include(GX_PATH.'/inc/lib/Control/Error/'.$vars.'.control.php');
         }else{
-            include(GX_PATH.'/inc/lib/Control/Error/404.control.php');
+            include(GX_PATH.'/inc/lib/Control/Error/unknown.control.php');
         }
     }
 
     /**
     * Control Install Handler Function.
diff --git a/inc/lib/Control/Backend/categories.control.php b/inc/lib/Control/Backend/categories.control.php
index 1fb8242..598dedc 100644
--- a/inc/lib/Control/Backend/categories.control.php
+++ b/inc/lib/Control/Backend/categories.control.php
@@ -14,39 +14,72 @@
 
 $data[] = "";
 switch (isset($_POST['addcat'])) {
     case true:
         # code...
-        $slug = Typo::slugify($_POST['cat']);
-        $cat = Db::insert("INSERT INTO `cat` VALUES ('', '{$_POST['cat']}', '{$slug}', '{$_POST['parent']}', '' )");
+        if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+            // VALIDATE ALL
+            $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+        }
+        if(isset($alertred)){
+            $data['alertred'] = $alertred;
+        }else{
+            $slug = Typo::slugify(Typo::cleanX($_POST['cat']));
+            $cat = Typo::cleanX($_POST['cat']);
+            $cat = Db::insert(
+                        sprintf("INSERT INTO `cat` VALUES (null, '%s', '%s', '%d', '' )", 
+                            $cat, $slug, $_POST['parent']
+                        )
+                    );
+            //print_r($cat);
+            $data['alertgreen'][] = "Category Added: ".$_POST['cat'];
+        }
         break;
     
     default:
         # code...
         break;
 }
 
 switch (isset($_POST['updatecat'])) {
     case true:
         # code...
-        $vars = array(
-                    'table' => 'cat',
-                    'id' => $_POST['id'],
-                    'key' => array(
-                                'name' => $_POST['cat']
-                            )
-                );
-        $cat = Db::update($vars);
+        if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+            // VALIDATE ALL
+            $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+        }
+        if(isset($alertred)){
+            $data['alertred'] = $alertred;
+        }else{
+            $vars = array(
+                        'table' => 'cat',
+                        'id' => $_POST['id'],
+                        'key' => array(
+                                    'name' => Typo::cleanX($_POST['cat'])
+                                )
+                    );
+            $cat = Db::update($vars);
+            $data['alertgreen'][] = "Category Updated: ".$_POST['cat'];
+        }
         break;
     
     default:
         # code...
         break;
 }
 
 if(isset($_GET['act']) == 'del'){
-    Categories::delete($_GET['id']);
+    if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
+        // VALIDATE ALL
+        $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+    }
+    if(isset($alertred)){
+        $data['alertred'] = $alertred;
+    }else{
+        Categories::delete($_GET['id']);
+        $data['alertgreen'][] = "Category Removed";
+    }
 }
 $data['cat'] = Db::result("SELECT * FROM `cat` ORDER BY `id` DESC");
 $data['num'] = Db::$num_rows;
 System::inc('categories', $data);
 
diff --git a/inc/lib/Control/Backend/menus.control.php b/inc/lib/Control/Backend/menus.control.php
index 87dd97c..f1a7125 100644
--- a/inc/lib/Control/Backend/menus.control.php
+++ b/inc/lib/Control/Backend/menus.control.php
@@ -25,65 +25,73 @@ switch ($act) {
             $submit = false;
         }
         switch ($submit) {
             case true:
                 # code...
-                $menus = Options::get('menus');
-                $menus = json_decode(Options::get('menus'), true);
-                echo "<pre>"; print_r($menus); echo "</pre>";
-                // $menu = array(
-                //                 $_POST['id']  =>  array(
-                //                             'name' => $menus[$_POST['id']]['name'],
-                //                             'class' => $menus[$_POST['id']]['class'],
-                //                             'menu' => array(
-                //                                     'parent' => $_POST['parent'],
-                //                                     'menuid' => $_POST['id'],
-                //                                     'type' => $_POST['type'],
-                //                                     'value' => $_POST[$_POST['type']]
-                //                                 )
-                //                         )
-                //                 );
-                
-                // if(is_array($menus)){
-                //     $menu = array_merge($menus, $menu);
-                // }
-                // echo "<pre>"; print_r($menu); echo "</pre>";
-                //$menu = $menus;
-                $menu[$_POST['id']]['menu'] = $menus[$_POST['id']]['menu'];
-                $menu[$_POST['id']]['menu'][] = array(
-                                                    'parent' => $_POST['parent'],
-                                                    'menuid' => $_POST['id'],
-                                                    'name' => $_POST['name'],
-                                                    'type' => $_POST['type'],
-                                                    'value' => $_POST[$_POST['type']],
-                                                    'sub' => ''
-                                                );
-                 $menu = array(
-                                $_POST['id']  =>  array(
-                                            'name' => $menus[$_POST['id']]['name'],
-                                            'class' => $menus[$_POST['id']]['class'],
-                                            'menu' => $menu[$_POST['id']]['menu']    
-                                        )
-                                );
-                if(is_array($menus)){
-                    $menu = array_merge($menus, $menu);
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
+                }else{
+                    $menus = Options::get('menus');
+                    $menus = json_decode(Options::get('menus'), true);
+                   //echo "<pre>"; print_r($menus); echo "</pre>";
+                    // $menu = array(
+                    //                 $_POST['id']  =>  array(
+                    //                             'name' => $menus[$_POST['id']]['name'],
+                    //                             'class' => $menus[$_POST['id']]['class'],
+                    //                             'menu' => array(
+                    //                                     'parent' => $_POST['parent'],
+                    //                                     'menuid' => $_POST['id'],
+                    //                                     'type' => $_POST['type'],
+                    //                                     'value' => $_POST[$_POST['type']]
+                    //                                 )
+                    //                         )
+                    //                 );
+                    
+                    // if(is_array($menus)){
+                    //     $menu = array_merge($menus, $menu);
+                    // }
+                    // echo "<pre>"; print_r($menu); echo "</pre>";
+                    //$menu = $menus;
+                    $menu[$_POST['id']]['menu'] = $menus[$_POST['id']]['menu'];
+                    $menu[$_POST['id']]['menu'][] = array(
+                                                        'parent' => $_POST['parent'],
+                                                        'menuid' => $_POST['id'],
+                                                        'name' => Typo::cleanX($_POST['name']),
+                                                        'type' => $_POST['type'],
+                                                        'value' => $_POST[$_POST['type']],
+                                                        'sub' => ''
+                                                    );
+                     $menu = array(
+                                    $_POST['id']  =>  array(
+                                                'name' => $menus[$_POST['id']]['name'],
+                                                'class' => $menus[$_POST['id']]['class'],
+                                                'menu' => $menu[$_POST['id']]['menu']    
+                                            )
+                                    );
+                    if(is_array($menus)){
+                        $menu = array_merge($menus, $menu);
+                    }
+                    //echo "<pre>"; print_r($menu); echo "</pre>";
+                    $menu = json_encode($menu);
+                    //echo "<pre>"; print_r($menu); echo "</pre>";
+                    //Options::update('menus', $menu);
+
+                    $vars = array(
+                                'parent' => $_POST['parent'],
+                                'menuid' => $_POST['id'],
+                                'name' => Typo::cleanX($_POST['name']),
+                                'class' => Typo::cleanX($_POST['class']),
+                                'type' => $_POST['type'],
+                                'value' => $_POST[$_POST['type']]
+                            );
+                    Menus::insert($vars);
+                    $data['alertgreen'][] = 'Menu Added';
                 }
-                 echo "<pre>"; print_r($menu); echo "</pre>";
-                $menu = json_encode($menu);
-                echo "<pre>"; print_r($menu); echo "</pre>";
-                //Options::update('menus', $menu);
-
-                $vars = array(
-                            'parent' => $_POST['parent'],
-                            'menuid' => $_POST['id'],
-                            'name' => $_POST['name'],
-                            'class' => $_POST['class'],
-                            'type' => $_POST['type'],
-                            'value' => $_POST[$_POST['type']]
-                        );
-                Menus::insert($vars);
-                $data['alertgreen'][] = 'Menu Added';
                 break;
             
             default:
                 # code...
 
@@ -93,11 +101,11 @@ switch ($act) {
         if(isset($_GET['id'])){
             $menuid = $_GET['id'];
         }else{
             $menuid = '';
         }
-        $data['parent'] = Menus::getParent('', $menuid);
+        $data['parent'] = Menus::isHadParent('', $menuid);
         //echo "<pre>"; print_r($data); echo "</pre>";
         System::inc('menus_form', $data);
         break;
 
     case 'edit':
@@ -108,26 +116,33 @@ switch ($act) {
         }else{
             $submit = false;
         }
         switch ($submit) {
             case true:
-                
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
+                }else{
 
-                $vars = array(
-                            // 'parent' => $_POST['parent'],
-                            'menuid' => $_POST['id'],
-                            'name' => $_POST['name'],
-                            'class' => $_POST['class'],
-                            'type' => $_POST['type'],
-                            'value' => $_POST[$_POST['type']]
-                        );
-                $vars = array(
-                            'id' => $_GET['itemid'],
-                            'key' => $vars
-                        );
-                Menus::update($vars);
-                $data['alertgreen'][] = 'Menu Updated';
+                    $vars = array(
+                                'parent' => $_POST['parent'],
+                                'menuid' => $_POST['id'],
+                                'name' => Typo::cleanX($_POST['name']),
+                                'class' => Typo::cleanX($_POST['class']),
+                                'type' => $_POST['type'],
+                                'value' => $_POST[$_POST['type']]
+                            );
+                    $vars = array(
+                                'id' => $_GET['itemid'],
+                                'key' => $vars
+                            );
+                    Menus::update($vars);
+                    $data['alertgreen'][] = 'Menu Updated';
+                }
                 break;
             
             default:
                 # code...
 
@@ -138,17 +153,25 @@ switch ($act) {
             $menuid = $_GET['id'];
         }else{
             $menuid = '';
         }
         $data['menus'] = Menus::getId($_GET['itemid']);
-        $data['parent'] = Menus::getParent('', $menuid);
+        $data['parent'] = Menus::isHadParent('', $menuid);
         System::inc('menus_form_edit', $data);
         break;
     case 'del':
         if(isset($_GET['itemid'])){
-            Menus::delete($_GET['itemid']);
-            $data['alertgreen'][] = 'Menu Deleted';
+            if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
+                // VALIDATE ALL
+                $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+            }
+            if(isset($alertred)){
+                $data['alertred'] = $alertred;
+            }else{
+                Menus::delete($_GET['itemid']);
+                $data['alertgreen'][] = 'Menu Deleted';
+            }
         }else{
             $data['alertred'][] = 'No ID Selected.';
         }
         break;
     default:
@@ -160,24 +183,32 @@ switch ($act) {
             $submit = false;
         }
         switch ($submit) {
             case true:
                 # code...
-                $menu = array(
-                                $_POST['id']  =>  array(
-                                            'name' => $_POST['name'],
-                                            'class' => $_POST['class'],
-                                            'menu' => array()
-                                        )
-                                );
-                $menus = json_decode(Options::get('menus'), true);
-                if(is_array($menus)){
-                    $menu = array_merge($menus, $menu);
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
+                }else{
+                    $menu = array(
+                                    $_POST['id']  =>  array(
+                                                'name' => Typo::cleanX($_POST['name']),
+                                                'class' => Typo::cleanX($_POST['class']),
+                                                'menu' => array()
+                                            )
+                                    );
+                    $menus = json_decode(Options::get('menus'), true);
+                    if(is_array($menus)){
+                        $menu = array_merge($menus, $menu);
+                    }
+                    
+                    $menu = json_encode($menu);
+                    Options::update('menus', $menu);
                 }
-                
-                $menu = json_encode($menu);
-                Options::update('menus', $menu);
                 break;
             
             default:
                 # code...
                 
@@ -194,21 +225,28 @@ switch ($act) {
             $submit = false;
         }
         switch ($submit) {
             case true:
                 
-
-                $vars = array(
-                            'parent' => $_POST['parent'],
-                            'menuid' => $_POST['id'],
-                            'name' => $_POST['name'],
-                            'class' => $_POST['class'],
-                            'type' => $_POST['type'],
-                            'value' => $_POST[$_POST['type']]
-                        );
-                Menus::insert($vars);
-                $data['alertgreen'][] = 'Menu Item Added';
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
+                }else{
+                    $vars = array(
+                                'parent' => $_POST['parent'],
+                                'menuid' => $_POST['id'],
+                                'name' => Typo::cleanX($_POST['name']),
+                                'class' => Typo::cleanX($_POST['class']),
+                                'type' => $_POST['type'],
+                                'value' => $_POST[$_POST['type']]
+                            );
+                    Menus::insert($vars);
+                    $data['alertgreen'][] = 'Menu Item Added';
+                }
                 break;
             
             default:
                 # code...
 
@@ -228,13 +266,20 @@ switch ($act) {
             case true:
                 # code...
                 // echo "<pre>";
                 // print_r($_POST['order']);
                 // echo "</pre>";
-
-                Menus::updateMenuOrder($_POST['order']);
-                $data['alertgreen'][] = 'Menu Order Changed';
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
+                }else{
+                    Menus::updateMenuOrder($_POST['order']);
+                    $data['alertgreen'][] = 'Menu Order Changed';
+                }
                 break;
             
             default:
                 # code...
                 break;
diff --git a/inc/lib/Control/Backend/pages.control.php b/inc/lib/Control/Backend/pages.control.php
index afcb27a..f6f62ec 100644
--- a/inc/lib/Control/Backend/pages.control.php
+++ b/inc/lib/Control/Backend/pages.control.php
@@ -21,27 +21,35 @@ switch ($act) {
         $data[''] = "";
 
         switch (isset($_POST['submit'])) {
             case true:
                 # code...
-                if (!isset($_POST['date']) || $_POST['date'] == "") {
-                    # code...
-                    $date = date("Y-m-d H:i:s");
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
                 }else{
-                    $date = $_POST['date'];
+                    if (!isset($_POST['date']) || $_POST['date'] == "") {
+                        # code...
+                        $date = date("Y-m-d H:i:s");
+                    }else{
+                        $date = $_POST['date'];
+                    }
+                    $vars = array(
+                                    'title' => Typo::cleanX($_POST['title']),
+                                    'content' => Typo::cleanX($_POST['content']),
+                                    'date' => $date,
+                                    'type' => 'page',
+                                    'author' => Session::val('username'),
+                                    'status' => $_POST['status'],
+                                );
+                    //print_r($vars);
+                    Posts::insert($vars);
+                    $data['alertgreen'][] = "Page : {$_POST['title']} Added.";
                 }
-                $vars = array(
-                                'title' => Typo::cleanX($_POST['title']),
-                                'content' => Typo::cleanX($_POST['content']),
-                                'date' => $date,
-                                'type' => 'page',
-                                'author' => Session::val('username'),
-                                'status' => $_POST['status'],
-                            );
-                //print_r($vars);
-                Posts::insert($vars);
-                $data['alertgreen'][] = "Page : {$_POST['title']} Added.";
                 break;
             
             default:
                 # code...
                 //System::inc('pages_form', $data);
@@ -53,27 +61,35 @@ switch ($act) {
     case 'edit':
         //echo "edit";
         switch (isset($_POST['submit'])) {
             case true:
                 # code...
-                if (!isset($_POST['date']) || $_POST['date'] == "") {
-                    # code...
-                    $date = date("Y-m-d H:i:s");
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
                 }else{
-                    $date = $_POST['date'];
+                    if (!isset($_POST['date']) || $_POST['date'] == "") {
+                        # code...
+                        $date = date("Y-m-d H:i:s");
+                    }else{
+                        $date = $_POST['date'];
+                    }
+                    $moddate = date("Y-m-d H:i:s");
+                    $vars = array(
+                                    'title' => Typo::cleanX($_POST['title']),
+                                    'content' => Typo::cleanX($_POST['content']),
+                                    'modified' => $moddate,
+                                    'date' => $date,
+                                    'status' => $_POST['status'],
+                                );
+                    //print_r($vars);
+                    Posts::update($vars);
+                    $data['alertgreen'][] = "Page : {$_POST['title']} Updated.";
                 }
-                $moddate = date("Y-m-d H:i:s");
-                $vars = array(
-                                'title' => Typo::cleanX($_POST['title']),
-                                'content' => Typo::cleanX($_POST['content']),
-                                'modified' => $moddate,
-                                'date' => $date,
-                                'status' => $_POST['status'],
-                            );
-                //print_r($vars);
-                Posts::update($vars);
-                $data['alertgreen'][] = "Page : {$_POST['title']} Updated.";
                 break;
             
             default:
                 # code...
                 //System::inc('posts_form', $data);
@@ -89,11 +105,19 @@ switch ($act) {
     default:
         # code...
         if(isset($_GET['act']) && $_GET['act'] == 'del'){
             if(isset($_GET['id'])){
                 $title = Posts::title($_GET['id']);
-                $del = Posts::delete($_GET['id']);
+                if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
+                }else{
+                    $del = Posts::delete($_GET['id']);
+                }
                 //echo $title['error'];
                 if(isset($del['error'])){
                     $data['alertred'][] = $del['error'];
                 }else{
                     $data['alertgreen'][] = 'Post <b>'.$title.'</b> Removed';
@@ -112,27 +136,51 @@ switch ($act) {
         if(isset($_POST['post_id'])) { $post_id = $_POST['post_id']; } else { $post_id = ""; }
         switch ($action) {
             
             case 'publish':
                 # code...
-                foreach ($post_id as $id) {
-                    # code...
-                    Posts::publish($id);
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
+                }else{
+                    foreach ($post_id as $id) {
+                        # code...
+                        Posts::publish($id);
+                    }
                 }
                 break;
             case 'unpublish':
                 # code...
-                foreach ($post_id as $id) {
-                    # code...
-                    Posts::unpublish($id);
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
+                }else{
+                    foreach ($post_id as $id) {
+                        # code...
+                        Posts::unpublish($id);
+                    }
                 }
                 break;
             case 'delete':
                 # code...
-                foreach ($post_id as $id) {
-                    # code...
-                    Posts::delete($id);
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
+                }else{
+                    foreach ($post_id as $id) {
+                        # code...
+                        Posts::delete($id);
+                    }
                 }
                 break;
             
             default:
                 # code...
diff --git a/inc/lib/Control/Backend/posts.control.php b/inc/lib/Control/Backend/posts.control.php
index 6084693..ce17feb 100644
--- a/inc/lib/Control/Backend/posts.control.php
+++ b/inc/lib/Control/Backend/posts.control.php
@@ -21,28 +21,37 @@ switch ($act) {
         # code...
         $data[] = '';
         switch (isset($_POST['submit'])) {
             case true:
                 # code...
-                if (!isset($_POST['date']) || $_POST['date'] == "") {
-                    # code...
-                    $date = date("Y-m-d H:i:s");
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if(isset($alertred)){
+                    $data['alertred'] = $alertred;
                 }else{
-                    $date = $_POST['date'];
+                    if (!isset($_POST['date']) || $_POST['date'] == "") {
+                        # code...
+                        $date = date("Y-m-d H:i:s");
+                    }else{
+                        $date = $_POST['date'];
+                    }
+                    $vars = array(
+                                    'title' => Typo::cleanX($_POST['title']),
+                                    'cat' => $_POST['cat'],
+                                    'content' => Typo::cleanX($_POST['content']),
+                                    'date' => $date,
+                                    'type' => 'post',
+                                    'author' => Session::val('username'),
+                                    'status' => $_POST['status'],
+                                );
+                    //print_r($vars);
+                    Posts::insert($vars);
+                    $data['alertgreen'][] = "Post : {$_POST['title']} Added.";
                 }
-                $vars = array(
-                                'title' => Typo::cleanX($_POST['title']),
-                                'cat' => $_POST['cat'],
-                                'content' => Typo::cleanX($_POST['content']),
-                                'date' => $date,
-                                'type' => 'post',
-                                'author' => Session::val('username'),
-                                'status' => $_POST['status'],
-                            );
-                //print_r($vars);
-                Posts::insert($vars);
-                $data['alertgreen'][] = "Post : {$_POST['title']} Added.";
+                    
                 break;
             
             default:
                 # code...
                 
@@ -55,24 +64,33 @@ switch ($act) {
     case 'edit':
         //echo "edit";
         switch (isset($_POST['submit'])) {
             case true:
                 # code...
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if (isset($alertred)) {
+                    # code...
+                    $data['alertred'] = $alertred;
+                }else{
+                    $moddate = date("Y-m-d H:i:s");
+                    $vars = array(
+                                    'title' => Typo::cleanX($_POST['title']),
+                                    'cat' => $_POST['cat'],
+                                    'content' => Typo::cleanX($_POST['content']),
+                                    'modified' => $moddate,
+                                    'date' => $_POST['date'],
+                                    'status' => $_POST['status'],
+                                );
+                    //print_r($vars);
+                    
+                    Posts::update($vars);
+                    $data['alertgreen'][] = "Post : <b>{$_POST['title']}</b> Updated.";
+                }
                 
-                $moddate = date("Y-m-d H:i:s");
-                $vars = array(
-                                'title' => Typo::cleanX($_POST['title']),
-                                'cat' => $_POST['cat'],
-                                'content' => Typo::cleanX($_POST['content']),
-                                'modified' => $moddate,
-                                'date' => $_POST['date'],
-                                'status' => $_POST['status'],
-                            );
-                //print_r($vars);
-                
-                Posts::update($vars);
-                $data['alertgreen'][] = "Post : <b>{$_POST['title']}</b> Updated.";
                 break;
             
             default:
                 # code...
                 //System::inc('posts_form', $data);
@@ -87,17 +105,27 @@ switch ($act) {
 
     default:
         # code...
         if(isset($_GET['act']) && $_GET['act'] == 'del'){
             if(isset($_GET['id'])){
-                $title = Posts::title($_GET['id']);
-                $del = Posts::delete($_GET['id']);
-                //echo $title['error'];
-                if(isset($del['error'])){
-                    $data['alertred'][] = $del['error'];
+                if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if (isset($alertred)) {
+                    # code...
+                    $data['alertred'] = $alertred;
                 }else{
-                    $data['alertgreen'][] = 'Post <b>'.$title.'</b> Removed';
+
+                    $title = Posts::title($_GET['id']);
+                    $del = Posts::delete($_GET['id']);
+                    //echo $title['error'];
+                    if(isset($del['error'])){
+                        $data['alertred'][] = $del['error'];
+                    }else{
+                        $data['alertgreen'][] = 'Post <b>'.$title.'</b> Removed';
+                    }
                 }
                 
             }else{
                 $data['alertred'][] = 'No ID Selected';
             }
@@ -111,27 +139,54 @@ switch ($act) {
         if(isset($_POST['post_id'])) { $post_id = $_POST['post_id']; } else { $post_id = ""; }
         switch ($action) {
 
             case 'publish':
                 # code...
-                foreach ($post_id as $id) {
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if (isset($alertred)) {
                     # code...
-                    Posts::publish($id);
+                    $data['alertred'] = $alertred;
+                }else{
+                    foreach ($post_id as $id) {
+                        # code...
+                        Posts::publish($id);
+                    }
                 }
                 break;
             case 'unpublish':
                 # code...
-                foreach ($post_id as $id) {
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if (isset($alertred)) {
                     # code...
-                    Posts::unpublish($id);
+                    $data['alertred'] = $alertred;
+                }else{
+                    foreach ($post_id as $id) {
+                        # code...
+                        Posts::unpublish($id);
+                    }
                 }
                 break;
             case 'delete':
                 # code...
-                foreach ($post_id as $id) {
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
+                if (isset($alertred)) {
                     # code...
-                    Posts::delete($id);
+                    $data['alertred'] = $alertred;
+                }else{
+                    foreach ($post_id as $id) {
+                        # code...
+                        Posts::delete($id);
+                    }
                 }
                 break;
             
             default:
                 # code...
diff --git a/inc/lib/Control/Backend/settings.control.php b/inc/lib/Control/Backend/settings.control.php
index cdb543f..beb5b24 100644
--- a/inc/lib/Control/Backend/settings.control.php
+++ b/inc/lib/Control/Backend/settings.control.php
@@ -12,58 +12,66 @@
 * @copyright 2014-2015 Puguh Wijayanto
 * @license http://www.opensource.org/licenses/mit-license.php MIT
 *
 */
 
-
+$data = "";
 switch (isset($_POST['change'])) {
     case '1':
         # code...
-        $vars = array();
-        if(isset($_FILES['logo']) && $_FILES['logo'] != ''){
-            $path = "/assets/images/";
-            $allowed = array('png', 'jpg', 'gif');
-            $upload = Upload::go('logo', $path, $allowed );
-            if(isset($upload['error']) != ''){
-                echo $upload['error'];
+        if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+            // VALIDATE ALL
+            $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+        }
+        if(isset($alertred)){
+            $data['alertred'] = $alertred;
+        }else{
+            $vars = array();
+            if(isset($_FILES['logo']) && $_FILES['logo'] != ''){
+                $path = "/assets/images/";
+                $allowed = array('png', 'jpg', 'gif');
+                $upload = Upload::go('logo', $path, $allowed );
+                if(isset($upload['error']) != ''){
+                    echo $upload['error'];
+                }else{
+                    $vars['logo'] = $upload['path'];
+                }
             }else{
-                $vars['logo'] = $upload['path'];
+                unset($_POST['logo']);
             }
-        }else{
-            unset($_POST['logo']);
-        }
 
-        
-        
-        //print_r($_POST);
-        $flip = array_flip($_POST);
-        $sql = "SELECT * FROM `options` WHERE `value` = 'on'";        
-        $q = Db::result($sql);
-        foreach($q as $ob) {
-            if( isset( $flip[$ob->name] ) ) {
-                $vars[$ob->name] = 'on';
-                //echo $ob->name;
-            }else{
-                $vars[$ob->name] = 'off';
-                //echo $ob->name;
+            
+            
+            //print_r($_POST);
+            $flip = array_flip($_POST);
+            $sql = "SELECT * FROM `options` WHERE `value` = 'on'";        
+            $q = Db::result($sql);
+            foreach($q as $ob) {
+                if( isset( $flip[$ob->name] ) ) {
+                    $vars[$ob->name] = 'on';
+                    //echo $ob->name;
+                }else{
+                    $vars[$ob->name] = 'off';
+                    //echo $ob->name;
+                }
             }
+            //print_r($ob);
+            foreach ($_POST as $key => $val) {
+                # code...
+                $vars[$key] = $val;
+            }
+            unset($vars['change']);
+            //print_r($vars);
+            Options::update($vars);
+            $data['alertgreen'][] = "New Settings Saved.";
         }
-        //print_r($ob);
-        foreach ($_POST as $key => $val) {
-            # code...
-            $vars[$key] = $val;
-        }
-        unset($vars['change']);
-        //print_r($vars);
-        Options::update($vars);
-
         break;
     
     default:
         # code...
         //print_r($data);
         break;
 }
-System::inc('settings');
+System::inc('settings',$data);
 
 /* End of file settings.control.php */
 /* Location: ./inc/lib/Control/Backend/settings.control.php */
\ No newline at end of file
diff --git a/inc/lib/Control/Backend/users.control.php b/inc/lib/Control/Backend/users.control.php
index e5c9481..09787ca 100644
--- a/inc/lib/Control/Backend/users.control.php
+++ b/inc/lib/Control/Backend/users.control.php
@@ -21,10 +21,15 @@ switch ($act) {
         # code...
         $data[] = "";
         switch (isset($_POST['edituser'])) {
             case true:
                 # code...
+                //check token first 
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
                 // VALIDATE ALL
                 if(!User::is_exist($_POST['userid'])){
                     $alertred[] = "User Exist!! Choose another userid.";
                 }
                 
@@ -57,10 +62,12 @@ switch ($act) {
                         $data['alertgreen'] = $alertgreen;
                     }
                 }else{
                     $data['alertred'] = $alertred;
                 }
+                
+                
                 break;
             
             default:
                 # code...
                 break;
@@ -68,12 +75,18 @@ switch ($act) {
         System::inc('user_form', $data);
         break;
     case 'del':
             if(isset($_GET['id'])){
                 $user = User::userid($_GET['id']);
-                User::delete($_GET['id']);
-                $data['alertgreen'][] = "User : ".$user." Removed";
+                if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
+                    // VALIDATE ALL
+                    $data['alertred'][] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }else{
+                    User::delete($_GET['id']);
+                    $data['alertgreen'][] = "User : ".$user." Removed";
+                }
+                
             }else{
                 $data['alertred'][] = "No ID selected";
             }
             $data['usr'] = Db::result("SELECT * FROM `user` ORDER BY `userid` ASC LIMIT 10");
             $data['num'] = Db::$num_rows;
@@ -83,11 +96,16 @@ switch ($act) {
         # code...
         $data[] = "";
         switch (isset($_POST['adduser'])) {
             case true:
                 # code...
-                // VALIDATE ALL
+                // CHECK TOKEN FIRST 
+                //echo Token::isExist($_POST['token']);
+                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
+                    // VALIDATE ALL
+                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
+                }
                 if(!User::is_exist($_POST['userid'])){
                     $alertred[] = "User Exist!! Choose another userid.";
                 }
                 if(!User::is_same($_POST['pass1'], $_POST['pass1'])){
                     $alertred[] = "Password Didn't Match!! Retype Your Password again.";
@@ -106,13 +124,15 @@ switch ($act) {
                                                     'group' => $_POST['group']
                                                 ),
                                     
                                 );   
                     User::create($vars);
+                    Token::remove(TOKEN);
                 }else{
                     $data['alertred'] = $alertred;
                 }
+
                 break;
             
             default:
                 # code...
                 break;
diff --git a/inc/lib/Control/Error/db.control.php b/inc/lib/Control/Error/db.control.php
new file mode 100644
index 0000000..ad9ef52
--- /dev/null
+++ b/inc/lib/Control/Error/db.control.php
@@ -0,0 +1,8 @@
+<h2>Database Error</h2>
+Something went wrong with the database.<br />
+<span style="border-radius: 7px; border: 3px solid #cc0000; line-height: 35px; 
+height: 50px; background-color: #aa0000; color: #fff; padding: 5px;">
+<?php
+echo $val;
+?>
+</span>
\ No newline at end of file
diff --git a/inc/lib/Control/Error/unknown.control.php b/inc/lib/Control/Error/unknown.control.php
new file mode 100644
index 0000000..da0ad16
--- /dev/null
+++ b/inc/lib/Control/Error/unknown.control.php
@@ -0,0 +1,10 @@
+<h2>Unknown Error Occured</h2>
+<?php if(isset($val)) {?>
+<div class="alert alert-danger">
+<?=$val;?>
+</div>
+
+<?php
+    }
+    Site::footer();
+?>
\ No newline at end of file
diff --git a/inc/lib/Control/Frontend/cat.control.php b/inc/lib/Control/Frontend/cat.control.php
index b6b34c7..bf976af 100644
--- a/inc/lib/Control/Frontend/cat.control.php
+++ b/inc/lib/Control/Frontend/cat.control.php
@@ -24,21 +24,24 @@ if(isset($_GET['paging'])){
 }
 $data['posts'] = Db::result(
                         sprintf("SELECT * FROM `posts` 
                             WHERE `type` = 'post' 
                             AND `cat` = '%d'
+                            AND `status` = '1'
                             ORDER BY `date` 
                             DESC LIMIT %d, %d",
                             $_GET['cat'], $offset, $data['max']
                             )
                         );
 $data['num'] = Db::$num_rows;
 if($data['num'] > 0) {
-    Theme::theme('header');
+    Theme::theme('header',$data);
     Theme::theme('cat', $data);
     Theme::footer();
+    exit;
 }else{
     Control::error('404');
+    exit;
 }
 
 /* End of file cat.control.php */
 /* Location: ./inc/lib/Control/Frontend/cat.control.php */
\ No newline at end of file
diff --git a/inc/lib/Control/Frontend/default.control.php b/inc/lib/Control/Frontend/default.control.php
index 160c9f7..bf4f3a8 100644
--- a/inc/lib/Control/Frontend/default.control.php
+++ b/inc/lib/Control/Frontend/default.control.php
@@ -22,17 +22,18 @@ if(isset($_GET['paging'])){
     $offset = 0;
 }
 $data['posts'] = Db::result(
                         sprintf("SELECT * FROM `posts` 
                             WHERE `type` = 'post' 
+                            AND `status` = '1'
                             ORDER BY `date` 
                             DESC LIMIT %d, %d",
                             $offset, $data['max']
                             )
                         );
 $data['num'] = Db::$num_rows;
-Theme::theme('header');
+Theme::theme('header',$data);
 Theme::theme('index', $data);
 Theme::footer();
 
 /* End of file default.control.php */
 /* Location: ./inc/lib/Control/Frontend/default.control.php */
\ No newline at end of file
diff --git a/inc/lib/Control/Frontend/page.control.php b/inc/lib/Control/Frontend/page.control.php
index efa5431..70628ab 100644
--- a/inc/lib/Control/Frontend/page.control.php
+++ b/inc/lib/Control/Frontend/page.control.php
@@ -16,31 +16,34 @@
 
 switch ($_GET['page']) {
     case 'sitemap':
         # code...
         Sitemap::create();
+        exit;
         break;
     
     default:
         # code...
         $page = $_GET['page'];
         $data['posts'] = Db::result(
                             sprintf("SELECT * FROM `posts` 
-                                    WHERE `id` = '%d' 
+                                    WHERE (`id` = '%d' OR `slug` = '%s')
                                     AND `type` = 'page'
-                                    OR `slug` = '%s' 
+                                    AND `status` = '1'
                                     LIMIT 1", 
                                     $page, 
-                                    $page
+                                    Typo::cleanX($page)
                                     )
                             );
         if(Db::$num_rows > 0) {
-            Theme::theme('header');
+            Theme::theme('header',$data);
             Theme::theme('page', $data);
             Theme::footer();
+            exit;
         }else{
             Control::error('404');
+            exit;
         }
         break;
 }
 
 /* End of file page.control.php */
diff --git a/inc/lib/Control/Frontend/post.control.php b/inc/lib/Control/Frontend/post.control.php
index 1277cf4..b474f7d 100644
--- a/inc/lib/Control/Frontend/post.control.php
+++ b/inc/lib/Control/Frontend/post.control.php
@@ -15,21 +15,26 @@
 */
 
 $post = $_GET[$vars];
 $data['posts'] = Db::result(
                     sprintf("SELECT * FROM `posts` 
-                            WHERE `id` = '%d' AND `type` = 'post' LIMIT 1",
+                            WHERE `id` = '%d' 
+                            AND `type` = 'post'
+                            AND `status` = '1' 
+                            LIMIT 1",
                             $post
                             )
                 );
 
 if(Db::$num_rows > 0) {
-    Theme::theme('header');
+    Theme::theme('header',$data);
     Theme::theme('single', $data);
     Theme::footer();
+    exit;
 }else{
     Control::error('404');
+    exit;
 }
 
 
 /* End of file post.control.php */
 /* Location: ./inc/lib/Control/Frontend/post.control.php */
\ No newline at end of file
diff --git a/inc/lib/Control/Install/default.control.php b/inc/lib/Control/Install/default.control.php
index 94af95f..7dca8bc 100644
--- a/inc/lib/Control/Install/default.control.php
+++ b/inc/lib/Control/Install/default.control.php
@@ -93,10 +93,11 @@ switch ($step){
                 config file is created, you can chmod it back to 755.
                 <br>
                 <br>
                 After You had set the permission, please refresh this page. 
                 <br>
+                <br>
                 or <a href=\"?step=4\" class=\"btn btn-primary\">Click Here</a>";
             }
         }catch (exception $e) {
             echo $e->getMessage();
         }
diff --git a/inc/lib/Db.class.php b/inc/lib/Db.class.php
index e00cbb4..a7b2705 100644
--- a/inc/lib/Db.class.php
+++ b/inc/lib/Db.class.php
@@ -46,12 +46,23 @@ class Db
         global $vars;
         if(DB_DRIVER == 'mysql') {
             mysql_connect(DB_HOST, DB_USER, DB_PASS);
             mysql_select_db(DB_NAME);
         }elseif(DB_DRIVER == 'mysqli') {
-            self::$mysqli = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
-            return self::$mysqli;
+            try {
+                self::$mysqli = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
+                if (self::$mysqli->connect_error) {
+                    Control::error('db', self::$mysqli->connect_error);
+                    exit;
+                }else{
+                    return true;
+                }
+            } catch (exception $e) {
+                Control::error('db', $e->getMessage() );
+            }
+            
+            //return self::$mysqli;
         }
     }
 
 
     /**
@@ -91,12 +102,11 @@ class Db
             $q = mysql_query($vars)  or die(mysql_error());
         } 
         elseif(DB_DRIVER == 'mysqli') {
             $q = self::$mysqli->query($vars) ;
             if($q === false) {
-                user_error("Query failed: ".self::$mysqli->error."<br />\n$vars"); 
-                return false; 
+                Control::error('db',"Query failed: ".self::$mysqli->error."<br />\n"); 
             }
         }
         
         return $q;
     }
@@ -263,11 +273,12 @@ class Db
             $q = mysql_query($sql) or die(mysql_error());
             self::$last_id = mysql_insert_id();
         }elseif(DB_DRIVER == 'mysqli'){
             try {
                 if(!self::query($sql)){
-                    printf("<div class=\"alert alert-danger\">Errormessage: %s</div>\n", self::$mysqli->error);
+                    // printf("<div class=\"alert alert-danger\">Errormessage: %s</div>\n", self::$mysqli->error);
+                    //Control::error('db',self::$mysqli->error);
                 }else{
                     self::$last_id = self::$mysqli->insert_id;
                 }
                 
             } catch (exception $e) {
diff --git a/inc/lib/GxMain.class.php b/inc/lib/GxMain.class.php
index a76f2c4..0312d61 100644
--- a/inc/lib/GxMain.class.php
+++ b/inc/lib/GxMain.class.php
@@ -36,10 +36,12 @@ class GxMain
     */
     public function __construct() {
         if (System::existConf()) {
             new System();
             new Db();
+            new Site();
+            Token::create();
         }else{
             $this->install();
         }
     }
 
diff --git a/inc/lib/Install.class.php b/inc/lib/Install.class.php
index 1ca5f84..0882c85 100644
--- a/inc/lib/Install.class.php
+++ b/inc/lib/Install.class.php
@@ -50,11 +50,11 @@ class Install
 * @link https://github.com/semplon/GeniXCMS
 * @author Puguh Wijayanto (www.metalgenix.com)
 * @copyright 2014-2015 Puguh Wijayanto
 * @license http://www.opensource.org/licenses/mit-license.php MIT
 *
-*/
+*/error_reporting(0);
 
 // DB CONFIG
 define('DB_HOST', '".Session::val('dbhost')."');
 define('DB_NAME', '".Session::val('dbname')."');
 define('DB_PASS', '".Session::val('dbpass')."');
@@ -64,10 +64,19 @@ define('DB_DRIVER', 'mysqli');
 
 define('THEME', 'default');
 define('GX_LANG', 'english');
 define('SMART_URL', false); //set 'true' if you want use SMART URL (SEO Friendly URL)
 define('GX_URL_PREFIX', '.html');
+
+
+
+
+
+
+
+
+// DON't REMOVE or EDIT THIS.
 define('SECURITY', '".Typo::getToken(200)."'); // for security purpose, will be used for creating password
 
         ";
         try{
             $f = fopen($file, "w");
@@ -189,11 +198,11 @@ define('SECURITY', '".Typo::getToken(200)."'); // for security purpose, will be
         $db->query($pr);
 
         $user_detail = "CREATE TABLE IF NOT EXISTS `user_detail` (
                 `id` bigint(20) NOT NULL,
                   `userid` varchar(32) COLLATE latin1_general_ci NOT NULL,
-                  `fname` varchar(32) COLLATE latin1_general_ci NOT NULL,
+                  `fname` varchar(32) COLLATE latin1_general_ci NULL,
                   `lname` varchar(255) COLLATE latin1_general_ci DEFAULT NULL,
                   `sex` varchar(2) COLLATE latin1_general_ci DEFAULT NULL,
                   `birthplace` varchar(32) COLLATE latin1_general_ci DEFAULT NULL,
                   `birthdate` date DEFAULT NULL,
                   `addr` varchar(255) COLLATE latin1_general_ci DEFAULT NULL,
@@ -270,9 +279,10 @@ define('SECURITY', '".Typo::getToken(200)."'); // for security purpose, will be
             (null, 'pinger', 'rpc.pingomatic.com\r\nblogsearch.google.com/ping/RPC2\r\nbing.com/webmaster/ping.aspx\r\nhttp://feedburner.google.com/fb/a/pingSubmit?bloglink=http%3A%2F%2F{{domain}}'),
             (null, 'bsvalidator_v', ''),
             (null, 'ppsandbox', 'off'),
             (null, 'ppuser', ''),
             (null, 'pppass', ''),
-            (null, 'ppsign', '')";
+            (null, 'ppsign', ''),
+            (null, 'tokens', '')";
         $db->query($options);
     }
 }
\ No newline at end of file
diff --git a/inc/lib/Mail.class.php b/inc/lib/Mail.class.php
index e20359e..b08088c 100644
--- a/inc/lib/Mail.class.php
+++ b/inc/lib/Mail.class.php
@@ -25,11 +25,11 @@ class Mail
     static $smtppass    = "";
     static $smtpssl     = "";
     static $siteemail   = "";
     static $sitename    = "";
     
-    function __construct()
+    public function __construct()
     {
         # code...
         self::$smtphost    = Options::get('smtphost');
         self::$smtpuser    = Options::get('smtpuser');
         self::$smtppass    = Options::get('smtppass');
diff --git a/inc/lib/Menus.class.php b/inc/lib/Menus.class.php
index 3ab23e0..c8ee372 100644
--- a/inc/lib/Menus.class.php
+++ b/inc/lib/Menus.class.php
@@ -1,38 +1,70 @@
 <?php if(!defined('GX_LIB')) die("Direct Access Not Allowed!");
-/*
-*    GeniXCMS - Content Management System
-*    ============================================================
-*    Build          : 20140925
-*    Version        : 0.0.1 pre
-*    Developed By   : Puguh Wijayanto (www.metalgenix.com)
-*    License        : MIT License
-*    ------------------------------------------------------------
-* filename : Menus.class.php
-* version : 0.0.1 pre
-* build : 20141007
+/**
+* GeniXCMS - Content Management System
+* 
+* PHP Based Content Management System and Framework
+*
+* @package GeniXCMS
+* @since 0.0.1 build date 20141007
+* @version 0.0.1
+* @link https://github.com/semplon/GeniXCMS
+* @author Puguh Wijayanto (www.metalgenix.com)
+* @copyright 2014-2015 Puguh Wijayanto
+* @license http://www.opensource.org/licenses/mit-license.php MIT
+*
+*/
+
+/**
+* Menus Class.
+* This class is for managing the menu at the dasboard. 
+*
+* @author Puguh Wijayanto (www.metalgenix.com)
+* @since 0.0.1
 */
 class Menus
 {
-
+    /**
+    * Menus Constructor.
+    * Nothing to construct
+    * @since 0.0.1
+    *
+    */
     public function __construct(){
-
     }
 
-    public static function getParent($parent='', $menuid = ''){
+
+    /**
+    * isHadParent Function
+    * 
+    * This function is to get the list of parent in certain conditions. There are 
+    * two paramaters to be inserted. 
+    * @param int $parent
+    * @param string $menuid
+    * 
+    * @author Puguh Wijayanto (www.metalgenix.com)
+    * @since 0.0.1
+    */
+    public static function isHadParent($parent='', $menuid = ''){
         if(isset($menuid)){
             $where = " AND `menuid` = '{$menuid}'";
         }else{
             $where = '';
         }
-        $sql = sprintf("SELECT * FROM `menus` WHERE `parent` = '%s' %s", $parent, $where);
+        if(isset($parent)){
+            $parent = " `parent` = '{$parent}'";
+        }else{
+            $parent = '1';
+        }
+        $sql = sprintf("SELECT * FROM `menus` WHERE %s %s", $parent, $where);
         $menu = Db::result($sql);
         return $menu;
     }
 
-    public static function isHadSub($parent, $menuid =''){
-        $sql = sprintf("SELECT * FROM `menus` WHERE `parent` = '%s' %s", $parent, $where);
+    public static function getParent($id){
+        $q = self::getId($id);
+        return $q[0]->parent;
     }
 
 
 
     /*   Menu for User Frontend
@@ -48,11 +80,11 @@ class Menus
         if($n > 0){
             $menu = "<ul class=\"menu-{$menuid} {$class}\">";
             foreach ($menus as $m) {
                 # code...
                 if($m->parent == ''){
-                    $parent = self::getParent($m->id, $menuid);
+                    $parent = self::isHadParent($m->id, $menuid);
                     $n = Db::$num_rows;
                     if($n > 0 && $bsnav) { 
                         $class = "class=\"dropdown\"";
                         $aclass = "dropdown-toggle\" data-toggle=\"dropdown";
                     }else{ 
@@ -68,11 +100,11 @@ class Menus
                     if($n > 0){
                         $class = "dropdown-menu";
                         $menu .= "<ul class=\"submenu {$class}\" role=\"dropdown\">";
                             foreach ($menus as $m2) {
                                 if($m2->parent == $m->id){
-                                    $parent = self::getParent($m2->id, $menuid);
+                                    $parent = self::isHadParent($m2->id, $menuid);
                                     $n = Db::$num_rows;
                                     if($n > 0 && $bsnav) { 
                                         $class = "class=\"dropdown\"";
                                         $aclass = "dropdown-toggle\" data-toggle=\"dropdown";
                                     }else{ 
@@ -86,11 +118,11 @@ class Menus
                                         if($n > 0){
                                             $class = "dropdown-menu";
                                             $menu .= "<ul class=\"submenu {$class}\">";
                                             foreach ($menus as $m3) {
                                                 if($m3->parent == $m2->id){
-                                                    $parent = self::getParent($m3->id, $menuid);
+                                                    $parent = self::isHadParent($m3->id, $menuid);
                                                     $n = Db::$num_rows;
                                                     if($n > 0 && $bsnav) { 
                                                         $class = "class=\"dropdown\"";
                                                         $aclass = "dropdown-toggle\" data-toggle=\"dropdown";
                                                     }else{ 
@@ -105,11 +137,11 @@ class Menus
                                                         if($n > 0){
                                                             $class = "dropdown-menu";
                                                             $menu .= "<ul class=\"submenu {$class}\">";
                                                             foreach ($menus as $m4) {
                                                                 if($m4->parent == $m3->id){
-                                                                    $parent = self::getParent($m4->id, $menuid);
+                                                                    $parent = self::isHadParent($m4->id, $menuid);
                                                                     $n = Db::$num_rows;
                                                                     if($n > 0 && $bsnav) { 
                                                                         $class = "class=\"dropdown\"";
                                                                         $aclass = "dropdown-toggle\" data-toggle=\"dropdown";
                                                                     }else{ 
@@ -165,14 +197,14 @@ class Menus
                 # code...
                 if($m->parent == ''){
                     $menu .= "<li clas=\"form-inline\"><div class=\"row\">";
                     $menu .= "
                             <h4 class=\"col-md-10\">".$m->name." 
-                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m->id}\" class=\"label label-primary pull-right\" >
+                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                     <span class=\"glyphicon glyphicon-edit\"></span>
                                 </a>
-                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m->id}\" class=\"label label-danger pull-right\" >
+                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m->id}&token=".TOKEN."\" class=\"label label-danger pull-right\" >
                                     <span class=\"glyphicon glyphicon-remove\"></span>
                                 </a>
                             </h4>
                             <div class=\"pull-right col-md-2\">
                                     <input type=\"text\" value=\"$m->order\" name=\"order[$m->id][order]\" class=\"form-control text-center\">
@@ -181,22 +213,22 @@ class Menus
                         </div>
                         ";
                     
                     $parent = $m->id;
                     //echo $parent;
-                    $parent = self::getParent($m->id, $menuid);
+                    $parent = self::isHadParent($m->id, $menuid);
                     $n = Db::$num_rows;
                     if($n > 0){
                         $menu .= "<ul class=\"submenu {$class}\">";
                             foreach ($menus as $m2) {
                                 if($m2->parent == $m->id){
                                     $menu .= "<li><div class=\"row\">";
                                     $menu .= "<h5 class=\"col-md-10\">".$m2->name."
-                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m2->id}\" class=\"label label-primary pull-right\" >
+                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m2->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                                     <span class=\"glyphicon glyphicon-edit\"></span>
                                                 </a>
-                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m2->id}\" class=\"label label-danger pull-right\" >
+                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m2->id}&token=".TOKEN."\" class=\"label label-danger pull-right\" >
                                                     <span class=\"glyphicon glyphicon-remove\"></span>
                                                 </a>
 
                                             </h5>";
                                     $menu .= "
@@ -205,43 +237,43 @@ class Menus
 
                                             </div>
                                         </div>
                                         
                                                 ";
-                                        $parent = self::getParent($m2->id, $menuid);
+                                        $parent = self::isHadParent($m2->id, $menuid);
                                         $n = Db::$num_rows;
                                         if($n > 0){
                                             $menu .= "<ul class=\"submenu {$class}\">";
                                             foreach ($menus as $m3) {
                                                 if($m3->parent == $m2->id){
                                                     $menu .= "<li><div class=\"row\">";
                                                     $menu .= "<h6 class=\"col-md-10\">".$m3->name."
-                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m3->id}\" class=\"label label-primary pull-right\" >
+                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m3->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                                                     <span class=\"glyphicon glyphicon-edit\"></span>
                                                                 </a>
-                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m3->id}\" class=\"label label-danger pull-right\" >
+                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m3->id}&token=".TOKEN."\" class=\"label label-danger pull-right\" >
                                                                     <span class=\"glyphicon glyphicon-remove\"></span>
                                                                 </a>
                                                             </h6>";
                                                     $menu .= "
                                                             <div class=\"pull-right col-md-2\">
                                                                     <input type=\"text\" value=\"$m3->order\" name=\"order[$m3->id][order]\" class=\"form-control text-center\">
                                                             </div>
                                                         </div>
                                                                 ";
-                                                        $parent = self::getParent($m3->id, $menuid);
+                                                        $parent = self::isHadParent($m3->id, $menuid);
                                                         $n = Db::$num_rows;
                                                         if($n > 0){
                                                             $menu .= "<ul class=\"submenu {$class}\">";
                                                             foreach ($menus as $m4) {
                                                                 if($m4->parent == $m3->id){
                                                                     $menu .= "<li><div class=\"row\">";
                                                                     $menu .= "<h6 class=\"col-md-10\">".$m4->name."
-                                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m4->id}\" class=\"label label-primary pull-right\" >
+                                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m4->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                                                                     <span class=\"glyphicon glyphicon-edit\"></span>
                                                                                 </a>
-                                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m4->id}\" class=\"label label-primary pull-right\" >
+                                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m4->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                                                                     <span class=\"glyphicon glyphicon-remove\"></span>
                                                                                 </a>
                                                                             </h6>";
                                                                     $menu .= "
                                                                         <div class=\"pull-right col-md-2\">
@@ -297,11 +329,11 @@ class Menus
         return $menus;
     }
 
     public static function getId($id=''){
         if(isset($id)){
-            $sql = sprintf("SELECT * FROM `menus` WHERE `id` = '%d' ORDER BY `order` ASC", $id);
+            $sql = sprintf("SELECT * FROM `menus` WHERE `id` = '%d'", $id);
             $menus = Db::result($sql);
             $n = Db::$num_rows;
         }else{
             $menus = '';
         }
diff --git a/inc/lib/Options.class.php b/inc/lib/Options.class.php
index 073cd93..a6a426c 100644
--- a/inc/lib/Options.class.php
+++ b/inc/lib/Options.class.php
@@ -20,30 +20,25 @@ class Options
 
     public function __construct() {
     }
 
     // $vars = array(
-    //             'title' => '',
-    //             'cat' => '',
-    //             'content' => '',
-    //             'date' => '',
-    //             'author' => '',
-    //             'type' => '',
-    //             'status' => ''
+    //             'name' => '',
+    //             'value' => ''
     //         );
     public static function insert($vars) {
         if(is_array($vars)) {
-            $slug = Typo::slugify($vars['title']);
-            $vars = array_merge($vars, array('slug' => $slug));
-            //print_r($vars);
             $ins = array(
                         'table' => 'options',
-                        'key' => $vars
+                        'name' => $vars['name'],
+                        'value' => $vars['value']
                     );
-            $post = Db::insert($ins);
+            $opt = Db::insert($ins);
+        }else{
+            Control::error('unknown','Format not Found, please in array');
         }
-        return $post;
+        return $opt;
     }
 
     public static function update($key, $val = '') {
         if(is_array($key)){
             foreach ($key as $k => $v) {
diff --git a/inc/lib/Posts.class.php b/inc/lib/Posts.class.php
index 92a6928..3b9ddb1 100644
--- a/inc/lib/Posts.class.php
+++ b/inc/lib/Posts.class.php
@@ -119,11 +119,11 @@ class Posts
         $c = Typo::Xclean($vars);
         return $c;
     }
 
     public static function recent($vars, $type = 'post') {
-        $sql = "SELECT * FROM `posts` WHERE `type` = '{$type}' ORDER BY `date` DESC LIMIT {$vars}";
+        $sql = "SELECT * FROM `posts` WHERE `type` = '{$type}' AND `status` = '1' ORDER BY `date` DESC LIMIT {$vars}";
         $posts = Db::result($sql);
         if(isset($posts['error'])){
             $posts['error'] = "No Posts found.";
         }else{
             $posts = $posts;
@@ -165,11 +165,11 @@ class Posts
 
     public static function dropdown($vars){
         if(is_array($vars)){
             //print_r($vars);
             $name = $vars['name'];
-            $where = "WHERE ";
+            $where = "WHERE `status` = '1' AND ";
             if(isset($vars['type'])) {
                 $where .= " `type` = '{$vars['type']}' AND ";
             }else{
                 $where .= " ";
             }
diff --git a/inc/lib/Rss.class.php b/inc/lib/Rss.class.php
index d34adde..205a30b 100644
--- a/inc/lib/Rss.class.php
+++ b/inc/lib/Rss.class.php
@@ -25,13 +25,13 @@ class Rss
         header("Content-Type: text/xml");
         $xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>";
         $xml .= "
             <rss version=\"2.0\">
                 <channel>
-                    <title>".Options::get('sitename')."</title>
-                    <link>".Options::get('siteurl')."</link>
-                    <description>".Options::get('sitedesc')."</description>
+                    <title>".Site::$name."</title>
+                    <link>".Site::$url."</link>
+                    <description>".Site::$desc."</description>
             ";
         foreach ($posts as $p) {
             # code...
             $xml .= "
                 <item>
diff --git a/inc/lib/Site.class.php b/inc/lib/Site.class.php
index 36124b1..b294db8 100644
--- a/inc/lib/Site.class.php
+++ b/inc/lib/Site.class.php
@@ -17,15 +17,25 @@
 
 class Site
 {
     static $editors;
     static $data;
+    static $url;
+    static $domain;
+    static $name;
+    static $key;
+    static $desc;
 
     public function __construct() {
         global $GLOBALS, $data;
         self::$editors =& $GLOBALS;
         self::$data =& $data;
+        self::$url = Options::get('siteurl');
+        self::$domain = Options::get('sitedomain');
+        self::$name = Options::get('sitename');
+        self::$key = Options::get('sitekeywords');
+        self::$desc = Options::get('sitedesc');
     }
 
     /* Call all Website Meta at Header
     *
     */
@@ -34,11 +44,11 @@ class Site
         //print_r($data);
         //if(empty($data['posts'][0]->title)){ 
 
         if(is_array($data) && isset($data['posts'][0]->title)){
             
-            $sitenamelength = strlen(Options::get('sitename'));
+            $sitenamelength = strlen(self::$name);
             $limit = 70-$sitenamelength-6;
             $cont_title = substr(Typo::Xclean(Typo::strip($data['posts'][0]->title)),0,$limit);
             $titlelength = strlen($data['posts'][0]->title);
             if($titlelength > $limit+3) { $dotted = "...";} else {$dotted = "";}
             $cont_title = "{$pre} {$cont_title}{$dotted} - ";
@@ -52,12 +62,12 @@ class Site
         }
 
         $meta = "
     <!--// Start Meta: Generated Automaticaly by GeniXCMS -->
     <!-- SEO: Title stripped 70chars for SEO Purpose -->
-    <title>{$cont_title}".Options::get('sitename')."</title>
-    <meta name=\"Keyword\" content=\"".Options::get('sitekeywords')."\">
+    <title>{$cont_title}".self::$name."</title>
+    <meta name=\"Keyword\" content=\"".self::$key."\">
     <!-- SEO: Description stripped 150chars for SEO Purpose -->
     <meta name=\"Description\" content=\"".self::desc($desc)."\">
     <meta name=\"Author\" content=\"Puguh Wijayanto | MetalGenix IT Solutions - www.metalgenix.com\">
     <meta name=\"Generator\" content=\"GeniXCMS\">
     <meta name=\"robots\" content=\"".Options::get('robots')."\">
@@ -75,11 +85,11 @@ class Site
         //echo $GLOBALS['editor'].' one '. self::$editors;
         $foot ="";
         $bs = Options::get('use_bootstrap');
         if($bs == 'on'){
             $foot .= "
-    <link href=\"".Options::get('siteurl')."/assets/css/bootstrap.min.css\" rel=\"stylesheet\">\n";
+    <link href=\"".self::$url."/assets/css/bootstrap.min.css\" rel=\"stylesheet\">\n";
         }
 
         $jquery = Options::get('use_jquery');
         $jquery_v = Options::get('jquery_v');
         if($jquery == 'on'){
@@ -89,12 +99,12 @@ class Site
 
         $bs = Options::get('use_bootstrap');
         if($bs == 'on'){
             $foot .= "
             <!-- These files are included by default by GeniXCMS. You can set it at the dashboard -->
-            \t<script src=\"".Options::get('siteurl')."/assets/js/bootstrap.min.js\"></script>
-            \t<script src=\"".Options::get('siteurl')."/assets/js/ie10-viewport-bug-workaround.js\"></script>";
+            \t<script src=\"".self::$url."/assets/js/bootstrap.min.js\"></script>
+            \t<script src=\"".self::$url."/assets/js/ie10-viewport-bug-workaround.js\"></script>";
         }
 
         $fa = Options::get('use_fontawesome');
         if($fa == 'on'){
             $foot .= "
@@ -109,15 +119,15 @@ class Site
             \t<link rel=\"stylesheet\" href=\"http://cdnjs.cloudflare.com/ajax/libs/codemirror/3.20.0/theme/monokai.min.css\">
             \t<script type=\"text/javascript\" src=\"http://cdnjs.cloudflare.com/ajax/libs/codemirror/3.20.0/codemirror.js\"></script>
             \t<script src=\"http://cdnjs.cloudflare.com/ajax/libs/codemirror/3.20.0/mode/xml/xml.min.js\"></script>
             \t<script src=\"http://cdnjs.cloudflare.com/ajax/libs/codemirror/2.36.0/formatting.min.js\"></script>
 
-            \t<link href=\"".Options::get('siteurl')."/assets/css/summernote.css\" rel=\"stylesheet\">
-            \t<script src=\"".Options::get('siteurl')."/assets/js/summernote.min.js\"></script>
-            \t<script src=\"".Options::get('siteurl')."/assets/js/plugins/summernote-ext-fontstyle.js\"></script>
-            \t<script src=\"".Options::get('siteurl')."/assets/js/plugins/summernote-ext-hello.js\"></script>
-            \t<script src=\"".Options::get('siteurl')."/assets/js/plugins/summernote-ext-video.js\"></script>
+            \t<link href=\"".self::$url."/assets/css/summernote.css\" rel=\"stylesheet\">
+            \t<script src=\"".self::$url."/assets/js/summernote.min.js\"></script>
+            \t<script src=\"".self::$url."/assets/js/plugins/summernote-ext-fontstyle.js\"></script>
+            \t<script src=\"".self::$url."/assets/js/plugins/summernote-ext-hello.js\"></script>
+            \t<script src=\"".self::$url."/assets/js/plugins/summernote-ext-video.js\"></script>
             \t<script>
               \t$(document).ready(function() {
                 \t$('.editor').summernote({
                     \theight: 300,
                     \ttoolbar: [
@@ -166,12 +176,12 @@ class Site
               ";
         }
 
         if(isset($GLOBALS['validator']) && $GLOBALS['validator'] == true){
             $foot .= "
-            \t<link href=\"".Options::get('siteurl')."/assets/css/bootstrapValidator.min.css\" rel=\"stylesheet\">
-            \t<script src=\"".Options::get('siteurl')."/assets/js/bootstrapValidator.min.js\"></script>
+            \t<link href=\"".self::$url."/assets/css/bootstrapValidator.min.css\" rel=\"stylesheet\">
+            \t<script src=\"".self::$url."/assets/js/bootstrapValidator.min.js\"></script>
             ";
 
             $foot .= $GLOBALS['validator_js'];
 
         }
@@ -180,25 +190,25 @@ class Site
         echo $foot;
     }
 
     public static function desc($vars){
         if(!empty($vars)){
-            $desc = substr(strip_tags(htmlspecialchars_decode($vars).". ".Options::get('sitedesc')),0,150);
+            $desc = substr(strip_tags(htmlspecialchars_decode($vars).". ".self::$desc),0,150);
         }else{
-            $desc = substr(Options::get('sitedesc'),0,150);
+            $desc = substr(self::$desc,0,150);
         }
         
         return $desc;
     }
 
     public static function logo ($width='', $height='') {
         // check which logo is used, logourl or uploaded files.
         if( Options::get('is_logourl') == "on" && Options::get('logourl') != "" ) {
-            $logo = "<img src=\"".Options::get('siteurl').Options::get('logourl')."\"
+            $logo = "<img src=\"".self::$url.Options::get('logourl')."\"
                     style=\"width: $width; height: $height; margin: 1px;\">";
         }elseif( Options::get('is_logourl') == "off" && Options::get('logo') != "" ){
-            $logo = "<img src=\"".Options::get('siteurl').Options::get('logo')."\"
+            $logo = "<img src=\"".self::$url.Options::get('logo')."\"
                     style=\"width: $width; height: $height; margin: 1px;\">";
         }else{
             $logo = "<span class=\"mg genixcms-logo\"></span>";
         }
         return $logo;
diff --git a/inc/lib/System.class.php b/inc/lib/System.class.php
index 135ccd9..a853c20 100644
--- a/inc/lib/System.class.php
+++ b/inc/lib/System.class.php
@@ -15,25 +15,46 @@
 */
 
 
 class System
 {
-
+    /** 
+    * GeniXCMS Version Variable 
+    * @return double
+    */
     static $version          = "0.0.1";
+
+    /** 
+    * GeniXCMS Version Release 
+    * @return string
+    */
     static $v_release        = "";
 
+    /**
+    * System Constructor.
+    * Initializing the system, check the config file, if exist run the config
+    * loader. 
+    * @author Puguh Wijayanto (www.metalgenix.com)
+    * @since 0.0.1
+    */
     public function __construct () {
         if (self::existConf()) {
             # code...
             self::config('config');
-            self::lang(GX_LANG);
+            self::lang(GX_LANG);            
         }else{
             GxMain::install();
         }
         
     }
 
+    /**
+    * System Library Loader.
+    * This will include library which is called.
+    * @author Puguh Wijayanto (www.metalgenix.com)
+    * @since 0.0.1
+    */
     public static function lib($var) {
         include(GX_LIB.$var.'.class.php');
     }
 
     
@@ -107,6 +128,6 @@ class System
 
 
 }
 
 /* End of file system.class.php */
-/* Location: ./inc/lib/system.class.php */
\ No newline at end of file
+/* Location: ./inc/lib/system.class.php */
diff --git a/inc/lib/Token.class.php b/inc/lib/Token.class.php
new file mode 100644
index 0000000..ae155b7
--- /dev/null
+++ b/inc/lib/Token.class.php
@@ -0,0 +1,119 @@
+<?php
+/**
+* GeniXCMS - Content Management System
+* 
+* PHP Based Content Management System and Framework
+*
+* @package GeniXCMS
+* @since 0.0.2 build date 20150309
+* @version 0.0.2
+* @link https://github.com/semplon/GeniXCMS
+* @author Puguh Wijayanto (www.metalgenix.com)
+* @copyright 2014-2015 Puguh Wijayanto
+* @license http://www.opensource.org/licenses/mit-license.php MIT
+*
+*/
+
+
+/**
+* Token Class
+*
+* @author Puguh Wijayanto (www.metalgenix.com)
+* @since 0.0.2
+*/
+class Token
+{
+    public function __construct () {
+
+    }
+
+    public static function create() {
+        self::ridOld();
+        $length = "80";
+        $token = "";
+        $codeAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+        $codeAlphabet.= "abcdefghijklmnopqrstuvwxyz";
+        $codeAlphabet.= "0123456789";
+        $codeAlphabet.= SECURITY;
+        for($i=0;$i<$length;$i++){
+            $token .= $codeAlphabet[Typo::crypto_rand_secure(0,strlen($codeAlphabet))];
+        }
+        $url = $_SERVER['REQUEST_URI'];
+        $url = htmlspecialchars($url, ENT_QUOTES, 'UTF-8');
+        $ip = $_SERVER['REMOTE_ADDR'];
+        $time = time();
+        define('TOKEN', $token);
+        define('TOKEN_URL', $url);
+        define('TOKEN_IP', $ip);
+        define('TOKEN_TIME', $time);
+        $json = self::json();
+        Options::update('tokens',$json);
+        return $token;
+    }
+
+    /**
+    * Json Token Function
+    *
+    * $token = [{'time','ip','url',token'},]
+    */
+    public static function json() {
+        $token = Options::get('tokens');
+        $token = json_decode($token, true);
+        $newtoken = array(
+                        TOKEN => array(
+                            'time' => TOKEN_TIME,
+                            'ip' => TOKEN_IP,
+                            'url' => TOKEN_URL
+                            )
+                    );
+        if(is_array($token)){
+            $newtoken = array_merge($token, $newtoken);
+        }
+
+        $newtoken = json_encode($newtoken);
+        return $newtoken;
+    }
+
+    public static function isExist($token){
+        $json = Options::get('tokens');
+        $tokens = json_decode($json, true);
+        if(array_key_exists($token, $tokens)){
+            $call = true;
+        }else{
+            $call = false;
+        }
+        return $call;
+    }
+
+    public static function remove($token){
+        $json = Options::get('tokens');
+        $tokens = json_decode($json, true);
+        unset($tokens[$token]);
+        $tokens = json_encode($tokens);
+        if(Options::update('tokens',$tokens)){
+            return true;
+        }else{
+            return false;
+        }
+    }
+
+    public static function ridOld() {
+        $json = Options::get('tokens');
+        $tokens = json_decode($json, true);
+        $time = time();
+        foreach ($tokens as $token => $value) {
+            # code...
+            //print_r($token);
+            if ($time - $value['time'] > 600) {
+                # code...
+                unset($tokens[$token]);
+            }
+        }
+        $tokens = json_encode($tokens);
+        if(Options::update('tokens',$tokens)){
+            return true;
+        }else{
+            return false;
+        }
+    }
+}
\ No newline at end of file
diff --git a/inc/lib/Upload.class.php b/inc/lib/Upload.class.php
index aa6c7c4..cfa5ba3 100644
--- a/inc/lib/Upload.class.php
+++ b/inc/lib/Upload.class.php
@@ -67,11 +67,11 @@ class Upload
                 ){
                     $result['filesize'] = filesize($filepath);
                     $result['filename'] = $uniqfile.$filename;
                     $result['path'] = $path.$uniqfile.$filename;
                     $result['filepath'] = $filepath;
-                    $result['fileurl'] = Options::get('siteurl').$path.$uniqfile.$filename;
+                    $result['fileurl'] = Site::$url.$path.$uniqfile.$filename;
 
                 }else{
                     $result['error'] = 'Cannot upload to directory, please check 
                     if directory is exist or You had permission to write it.';
                 }
diff --git a/inc/lib/Url.class.php b/inc/lib/Url.class.php
index 386e310..688d1e3 100644
--- a/inc/lib/Url.class.php
+++ b/inc/lib/Url.class.php
@@ -39,16 +39,16 @@ class Url
     */
     public static function post($vars) {
         switch (SMART_URL) {
             case true:
                 # code...
-                $url = Options::get('siteurl')."/".self::slug($vars)."/{$vars}";
+                $url = Site::$url."/".self::slug($vars)."/{$vars}";
                 break;
             
             default:
                 # code...
-                $url = Options::get('siteurl')."/index.php?post={$vars}";
+                $url = Site::$url."/index.php?post={$vars}";
                 break;
 
         }
 
         return $url;
@@ -64,16 +64,16 @@ class Url
     */
     public static function page($vars) {
         switch (SMART_URL) {
             case true:
                 # code...
-                $url = Options::get('siteurl')."/".self::slug($vars).GX_URL_PREFIX;
+                $url = Site::$url."/".self::slug($vars).GX_URL_PREFIX;
                 break;
             
             default:
                 # code...
-                $url = Options::get('siteurl')."/index.php?page={$vars}";
+                $url = Site::$url."/index.php?page={$vars}";
                 break;
 
         }
 
         return $url;
@@ -90,16 +90,16 @@ class Url
     */
     public static function cat($vars) {
         switch (SMART_URL) {
             case true:
                 # code...
-                $url = Options::get('siteurl')."/".$vars."/".Typo::slugify(Categories::name($vars));
+                $url = Site::$url."/".$vars."/".Typo::slugify(Categories::name($vars));
                 break;
             
             default:
                 # code...
-                $url = Options::get('siteurl')."/index.php?cat={$vars}";
+                $url = Site::$url."/index.php?cat={$vars}";
                 break;
 
         }
 
         return $url;
@@ -127,16 +127,16 @@ class Url
     */
     public static function sitemap() {
         switch (SMART_URL) {
             case true:
                 # code...
-                $url = Options::get('siteurl')."/sitemap".GX_URL_PREFIX;
+                $url = Site::$url."/sitemap".GX_URL_PREFIX;
                 break;
             
             default:
                 # code...
-                $url = Options::get('siteurl')."/index.php?page=sitemap";
+                $url = Site::$url."/index.php?page=sitemap";
                 break;
 
         }
 
         return $url;
@@ -152,16 +152,16 @@ class Url
     */
     public static function rss() {
         switch (SMART_URL) {
             case true:
                 # code...
-                $url = Options::get('siteurl')."/rss".GX_URL_PREFIX;
+                $url = Site::$url."/rss".GX_URL_PREFIX;
                 break;
             
             default:
                 # code...
-                $url = Options::get('siteurl')."/index.php?rss";
+                $url = Site::$url."/index.php?rss";
                 break;
 
         }
 
         return $url;

Vulnerable code: */?>
                        if($c->parent == ""){
                                  <a href=\"?page=categories&act=del&id={$c->id}\" class=\"pull-right\"
                                        <form action=\"\" method=\"POST\" name=\"updatecat\">
                                            <a href=\"?page=categories&act=del&id={$c2->id}\" class=\"input-group-addon\"
                                    'parent' => '',
*/?>
                                              $data['parent'] = Menus::getParent('', $k);
    if(isset($data['alertgreen']) ) {
        echo "<div class=\"alert alert-success\">";
            foreach ($data['alertgreen'] as $alert) {
                echo "$alert"; 
            }
        echo "</div>"; }
                //print_r($data['parent']);
    if (isset($data['alertgreen'])) {
        echo "<div class=\"alert alert-success\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>";
        foreach ($data['alertgreen'] as $alert) {
            # code...
            echo "$alert\n";
        }
        echo "</div>";
    if (isset($data['alertred'])) {
        echo "<div class=\"alert alert-danger\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>";
        foreach ($data['alertred'] as $alert) {
            # code...
            echo "$alert\n";
        }
        echo "</div>";
        <div class="table-responsive">
            <table class="table table-hover">
                <thead>
                    <tr>
                        <th>ID</th>
                        <th>Title</th>
                        <th>Date</th>
                        <th>Edit/Delete</th>
                        <th>All <input type="checkbox" id="selectall"></th>
                    </tr>
                </thead>
                <tbody>
                    <?php
                        //print_r($data);
                    if($data['num'] > 0){
                        foreach ($data['posts'] as $p) {
                            # code...
                            //echo $p->id;
                            <tr>
                                <td>{$p->id}</td>
                                <td><a href=\"".Url::page($p->id)."\" target=\"_new\">{$p->title}</a></td>
                                <td>{$p->date}</td>
                                <td>
                                    <a href=\"index.php?page=pages&act=edit&id={$p->id}\" class=\"label label-success\">Edit</a> 
                                    <a href=\"index.php?page=pages&act=del&id={$p->id}\" class=\"label label-danger\" 
                                    onclick=\"return confirm('Are you sure you want to delete this item?');\">Delete</a>
                                </td>
                                    <input type=\"checkbox\" name=\"post_id[]\" value=\"{$p->id}\" id=\"select\">
                                </td>
                            </tr>
                            ";
                    }else{
                        echo "
                            <tr>
                                <td>
                                    No Pages Found 
                                </td>
                            </tr>";
                    }
                    ?>
                </tbody>
                <tfoot>
                    <th>ID</th>
                    <th>Title</th>
                    <th>Date</th>
                    <th>
                    <select name="action" class="form-control">
                        <option value="publish">Publish</option>
                        <option value="unpublish">UnPublish</option>
                        <option value="delete">Delete</option>
                    </select>
                    </th>
                    <th>
                        <button type="submit" name="doaction" class="btn btn-danger">
                            Submit
                        </button>
                    </th>
                </tfoot>
            </table>
        </div>
    if (isset($data['alertgreen'])) {
        echo "<div class=\"alert alert-success\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>
        ";
        foreach ($data['alertgreen'] as $alert) {
            # code...
            echo "$alert\n";
        }
        echo "</div>";
<form action="" method="post" role="form" class="">
                                <a href=\"index.php?page=posts&act=edit&id={$p->id}\" class=\"label label-success\">Edit</a> 
                                <a href=\"index.php?page=posts&act=del&id={$p->id}\" class=\"label label-danger\" 
    if (isset($data['alertgreen'])) {
        echo "<div class=\"alert alert-success\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>";
        foreach ($data['alertgreen'] as $alert) {
            # code...
            echo "$alert\n";
        }
        echo "</div>";
    if (isset($data['alertred'])) {
        echo "<div class=\"alert alert-danger\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>";
        foreach ($data['alertred'] as $alert) {
            # code...
            echo "$alert\n";
        }
        echo "</div>";
    if(isset($data['post'])) {
        foreach ($data['post'] as $p) {
            # code...
            $title = $p->title;
            $content = $p->content;
            $date = $p->date;
            $status = $p->status;
            $cat = $p->cat;
        }
        if($status == 1) {
            $pub = "SELECTED"; 
            $unpub = ""; 
        }elseif ($status == 0) {
            $pub = ""; 
            $unpub = "SELECTED";
        }
    }else{
        $title = "";
        $content = "";
        $date = "";
        $status = "";
        $cat = "";
        $pub = "";
        $unpub = "";
<form action="" method="post" role="form" class="">
        <h1><i class="fa fa-file-text-o"></i> New Post
*/?>
                          <input type="text" name="sitename" value="<?=Options::get('sitename');?>" class="form-control">
                          <input type="text" name="sitedomain" value="<?=Options::get('sitedomain');?>" class="form-control">
                          <input type="text" name="siteurl" value="<?=Options::get('siteurl');?>" class="form-control">
                          <input type="text" name="sitekeywords" value="<?=Options::get('sitekeywords');?>" class="form-control">
                          <textarea  name="sitedesc" class="form-control"><?=Options::get('sitedesc');?></textarea>
                                $logoimg = "<img src=\"".Options::get('siteurl').Options::get('logo')."\" class=\"clearfix\">";
                            <a href=\"index.php?page=users&act=edit&id={$p->id}\" class=\"label label-success\">Edit</a> 
                            <a href=\"index.php?page=users&act=del&id={$p->id}\" class=\"label label-danger\" 
                            onclick=\"return confirm('Are you sure you want to delete this item?');\">Delete</a>
                    <input type="password" name="email" class="form-control">
    if (isset($data['alertgreen'])) {
        echo "<div class=\"alert alert-success\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>
        <ul>";
        foreach ($data['alertgreen'] as $alert) {
            # code...
            echo "<li>$alert</li>\n";
        }
        echo "</ul></div>";
    }elseif (isset($data['alertred'])) {
        //print_r($data['alertred']);
        echo "<div class=\"alert alert-danger\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>
        <ul>";
        foreach ($data['alertred'] as $alert) {
            # code...
            echo "<li>$alert</li>\n";
        }
        echo "</ul></div>";
                if($c->parent == ''){
    public static function error ($vars="") {
            include(GX_PATH.'/inc/lib/Control/Error/404.control.php');
        $slug = Typo::slugify($_POST['cat']);
        $cat = Db::insert("INSERT INTO `cat` VALUES ('', '{$_POST['cat']}', '{$slug}', '{$_POST['parent']}', '' )");
        $vars = array(
                    'table' => 'cat',
                    'id' => $_POST['id'],
                    'key' => array(
                                'name' => $_POST['cat']
                            )
                );
        $cat = Db::update($vars);
    Categories::delete($_GET['id']);
                $menus = Options::get('menus');
                $menus = json_decode(Options::get('menus'), true);
                echo "<pre>"; print_r($menus); echo "</pre>";
                // $menu = array(
                //                 $_POST['id']  =>  array(
                //                             'name' => $menus[$_POST['id']]['name'],
                //                             'class' => $menus[$_POST['id']]['class'],
                //                             'menu' => array(
                //                                     'parent' => $_POST['parent'],
                //                                     'menuid' => $_POST['id'],
                //                                     'type' => $_POST['type'],
                //                                     'value' => $_POST[$_POST['type']]
                //                                 )
                //                         )
                //                 );
                
                // if(is_array($menus)){
                //     $menu = array_merge($menus, $menu);
                // }
                // echo "<pre>"; print_r($menu); echo "</pre>";
                //$menu = $menus;
                $menu[$_POST['id']]['menu'] = $menus[$_POST['id']]['menu'];
                $menu[$_POST['id']]['menu'][] = array(
                                                    'parent' => $_POST['parent'],
                                                    'menuid' => $_POST['id'],
                                                    'name' => $_POST['name'],
                                                    'type' => $_POST['type'],
                                                    'value' => $_POST[$_POST['type']],
                                                    'sub' => ''
                                                );
                 $menu = array(
                                $_POST['id']  =>  array(
                                            'name' => $menus[$_POST['id']]['name'],
                                            'class' => $menus[$_POST['id']]['class'],
                                            'menu' => $menu[$_POST['id']]['menu']    
                                        )
                                );
                if(is_array($menus)){
                    $menu = array_merge($menus, $menu);
                 echo "<pre>"; print_r($menu); echo "</pre>";
                $menu = json_encode($menu);
                echo "<pre>"; print_r($menu); echo "</pre>";
                //Options::update('menus', $menu);

                $vars = array(
                            'parent' => $_POST['parent'],
                            'menuid' => $_POST['id'],
                            'name' => $_POST['name'],
                            'class' => $_POST['class'],
                            'type' => $_POST['type'],
                            'value' => $_POST[$_POST['type']]
                        );
                Menus::insert($vars);
                $data['alertgreen'][] = 'Menu Added';
        $data['parent'] = Menus::getParent('', $menuid);
                
                $vars = array(
                            // 'parent' => $_POST['parent'],
                            'menuid' => $_POST['id'],
                            'name' => $_POST['name'],
                            'class' => $_POST['class'],
                            'type' => $_POST['type'],
                            'value' => $_POST[$_POST['type']]
                        );
                $vars = array(
                            'id' => $_GET['itemid'],
                            'key' => $vars
                        );
                Menus::update($vars);
                $data['alertgreen'][] = 'Menu Updated';
        $data['parent'] = Menus::getParent('', $menuid);
            Menus::delete($_GET['itemid']);
            $data['alertgreen'][] = 'Menu Deleted';
                $menu = array(
                                $_POST['id']  =>  array(
                                            'name' => $_POST['name'],
                                            'class' => $_POST['class'],
                                            'menu' => array()
                                        )
                                );
                $menus = json_decode(Options::get('menus'), true);
                if(is_array($menus)){
                    $menu = array_merge($menus, $menu);
                
                $menu = json_encode($menu);
                Options::update('menus', $menu);

                $vars = array(
                            'parent' => $_POST['parent'],
                            'menuid' => $_POST['id'],
                            'name' => $_POST['name'],
                            'class' => $_POST['class'],
                            'type' => $_POST['type'],
                            'value' => $_POST[$_POST['type']]
                        );
                Menus::insert($vars);
                $data['alertgreen'][] = 'Menu Item Added';

                Menus::updateMenuOrder($_POST['order']);
                $data['alertgreen'][] = 'Menu Order Changed';
                if (!isset($_POST['date']) || $_POST['date'] == "") {
                    # code...
                    $date = date("Y-m-d H:i:s");
                    $date = $_POST['date'];
                $vars = array(
                                'title' => Typo::cleanX($_POST['title']),
                                'content' => Typo::cleanX($_POST['content']),
                                'date' => $date,
                                'type' => 'page',
                                'author' => Session::val('username'),
                                'status' => $_POST['status'],
                            );
                //print_r($vars);
                Posts::insert($vars);
                $data['alertgreen'][] = "Page : {$_POST['title']} Added.";
                if (!isset($_POST['date']) || $_POST['date'] == "") {
                    # code...
                    $date = date("Y-m-d H:i:s");
                    $date = $_POST['date'];
                $moddate = date("Y-m-d H:i:s");
                $vars = array(
                                'title' => Typo::cleanX($_POST['title']),
                                'content' => Typo::cleanX($_POST['content']),
                                'modified' => $moddate,
                                'date' => $date,
                                'status' => $_POST['status'],
                            );
                //print_r($vars);
                Posts::update($vars);
                $data['alertgreen'][] = "Page : {$_POST['title']} Updated.";
                $del = Posts::delete($_GET['id']);
                foreach ($post_id as $id) {
                    # code...
                    Posts::publish($id);
                foreach ($post_id as $id) {
                    # code...
                    Posts::unpublish($id);
                foreach ($post_id as $id) {
                    # code...
                    Posts::delete($id);
                if (!isset($_POST['date']) || $_POST['date'] == "") {
                    # code...
                    $date = date("Y-m-d H:i:s");
                    $date = $_POST['date'];
                $vars = array(
                                'title' => Typo::cleanX($_POST['title']),
                                'cat' => $_POST['cat'],
                                'content' => Typo::cleanX($_POST['content']),
                                'date' => $date,
                                'type' => 'post',
                                'author' => Session::val('username'),
                                'status' => $_POST['status'],
                            );
                //print_r($vars);
                Posts::insert($vars);
                $data['alertgreen'][] = "Post : {$_POST['title']} Added.";
                $moddate = date("Y-m-d H:i:s");
                $vars = array(
                                'title' => Typo::cleanX($_POST['title']),
                                'cat' => $_POST['cat'],
                                'content' => Typo::cleanX($_POST['content']),
                                'modified' => $moddate,
                                'date' => $_POST['date'],
                                'status' => $_POST['status'],
                            );
                //print_r($vars);
                
                Posts::update($vars);
                $data['alertgreen'][] = "Post : <b>{$_POST['title']}</b> Updated.";
                $title = Posts::title($_GET['id']);
                $del = Posts::delete($_GET['id']);
                //echo $title['error'];
                if(isset($del['error'])){
                    $data['alertred'][] = $del['error'];
                    $data['alertgreen'][] = 'Post <b>'.$title.'</b> Removed';
                foreach ($post_id as $id) {
                    Posts::publish($id);
                foreach ($post_id as $id) {
                    Posts::unpublish($id);
                foreach ($post_id as $id) {
                    Posts::delete($id);

        $vars = array();
        if(isset($_FILES['logo']) && $_FILES['logo'] != ''){
            $path = "/assets/images/";
            $allowed = array('png', 'jpg', 'gif');
            $upload = Upload::go('logo', $path, $allowed );
            if(isset($upload['error']) != ''){
                echo $upload['error'];
                $vars['logo'] = $upload['path'];
        }else{
            unset($_POST['logo']);
        }
        
        
        //print_r($_POST);
        $flip = array_flip($_POST);
        $sql = "SELECT * FROM `options` WHERE `value` = 'on'";        
        $q = Db::result($sql);
        foreach($q as $ob) {
            if( isset( $flip[$ob->name] ) ) {
                $vars[$ob->name] = 'on';
                //echo $ob->name;
            }else{
                $vars[$ob->name] = 'off';
                //echo $ob->name;
        //print_r($ob);
        foreach ($_POST as $key => $val) {
            # code...
            $vars[$key] = $val;
        }
        unset($vars['change']);
        //print_r($vars);
        Options::update($vars);

System::inc('settings');
                User::delete($_GET['id']);
                $data['alertgreen'][] = "User : ".$user." Removed";
                // VALIDATE ALL
    Theme::theme('header');
Theme::theme('header');
                                    WHERE `id` = '%d' 
                                    OR `slug` = '%s' 
                                    $page
            Theme::theme('header');
                            WHERE `id` = '%d' AND `type` = 'post' LIMIT 1",
    Theme::theme('header');
            self::$mysqli = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
            return self::$mysqli;
                user_error("Query failed: ".self::$mysqli->error."<br />\n$vars"); 
                return false; 
                    printf("<div class=\"alert alert-danger\">Errormessage: %s</div>\n", self::$mysqli->error);
*/
                  `fname` varchar(32) COLLATE latin1_general_ci NOT NULL,
            (null, 'ppsign', '')";
    function __construct()
/*
*    GeniXCMS - Content Management System
*    ============================================================
*    Build          : 20140925
*    Version        : 0.0.1 pre
*    Developed By   : Puguh Wijayanto (www.metalgenix.com)
*    License        : MIT License
*    ------------------------------------------------------------
* filename : Menus.class.php
* version : 0.0.1 pre
* build : 20141007


    public static function getParent($parent='', $menuid = ''){
        $sql = sprintf("SELECT * FROM `menus` WHERE `parent` = '%s' %s", $parent, $where);
    public static function isHadSub($parent, $menuid =''){
        $sql = sprintf("SELECT * FROM `menus` WHERE `parent` = '%s' %s", $parent, $where);
                    $parent = self::getParent($m->id, $menuid);
                                    $parent = self::getParent($m2->id, $menuid);
                                                    $parent = self::getParent($m3->id, $menuid);
                                                                    $parent = self::getParent($m4->id, $menuid);
                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m->id}\" class=\"label label-primary pull-right\" >
                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m->id}\" class=\"label label-danger pull-right\" >
                    $parent = self::getParent($m->id, $menuid);
                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m2->id}\" class=\"label label-primary pull-right\" >
                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m2->id}\" class=\"label label-danger pull-right\" >
                                        $parent = self::getParent($m2->id, $menuid);
                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m3->id}\" class=\"label label-primary pull-right\" >
                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m3->id}\" class=\"label label-danger pull-right\" >
                                                        $parent = self::getParent($m3->id, $menuid);
                                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m4->id}\" class=\"label label-primary pull-right\" >
                                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m4->id}\" class=\"label label-primary pull-right\" >
            $sql = sprintf("SELECT * FROM `menus` WHERE `id` = '%d' ORDER BY `order` ASC", $id);
    //             'title' => '',
    //             'cat' => '',
    //             'content' => '',
    //             'date' => '',
    //             'author' => '',
    //             'type' => '',
    //             'status' => ''
            $slug = Typo::slugify($vars['title']);
            $vars = array_merge($vars, array('slug' => $slug));
            //print_r($vars);
                        'key' => $vars
            $post = Db::insert($ins);
        return $post;
        $sql = "SELECT * FROM `posts` WHERE `type` = '{$type}' ORDER BY `date` DESC LIMIT {$vars}";
            $where = "WHERE ";
                    <title>".Options::get('sitename')."</title>
                    <link>".Options::get('siteurl')."</link>
                    <description>".Options::get('sitedesc')."</description>
            $sitenamelength = strlen(Options::get('sitename'));
    <title>{$cont_title}".Options::get('sitename')."</title>
    <meta name=\"Keyword\" content=\"".Options::get('sitekeywords')."\">
    <link href=\"".Options::get('siteurl')."/assets/css/bootstrap.min.css\" rel=\"stylesheet\">\n";
            \t<script src=\"".Options::get('siteurl')."/assets/js/bootstrap.min.js\"></script>
            \t<script src=\"".Options::get('siteurl')."/assets/js/ie10-viewport-bug-workaround.js\"></script>";
            \t<link href=\"".Options::get('siteurl')."/assets/css/summernote.css\" rel=\"stylesheet\">
            \t<script src=\"".Options::get('siteurl')."/assets/js/summernote.min.js\"></script>
            \t<script src=\"".Options::get('siteurl')."/assets/js/plugins/summernote-ext-fontstyle.js\"></script>
            \t<script src=\"".Options::get('siteurl')."/assets/js/plugins/summernote-ext-hello.js\"></script>
            \t<script src=\"".Options::get('siteurl')."/assets/js/plugins/summernote-ext-video.js\"></script>
            \t<link href=\"".Options::get('siteurl')."/assets/css/bootstrapValidator.min.css\" rel=\"stylesheet\">
            \t<script src=\"".Options::get('siteurl')."/assets/js/bootstrapValidator.min.js\"></script>
            $desc = substr(strip_tags(htmlspecialchars_decode($vars).". ".Options::get('sitedesc')),0,150);
            $desc = substr(Options::get('sitedesc'),0,150);
            $logo = "<img src=\"".Options::get('siteurl').Options::get('logourl')."\"
            $logo = "<img src=\"".Options::get('siteurl').Options::get('logo')."\"

            self::lang(GX_LANG);
/* Location: ./inc/lib/system.class.php */
                    $result['fileurl'] = Options::get('siteurl').$path.$uniqfile.$filename;
                $url = Options::get('siteurl')."/".self::slug($vars)."/{$vars}";
                $url = Options::get('siteurl')."/index.php?post={$vars}";
                $url = Options::get('siteurl')."/".self::slug($vars).GX_URL_PREFIX;
                $url = Options::get('siteurl')."/index.php?page={$vars}";
                $url = Options::get('siteurl')."/".$vars."/".Typo::slugify(Categories::name($vars));
                $url = Options::get('siteurl')."/index.php?cat={$vars}";
                $url = Options::get('siteurl')."/sitemap".GX_URL_PREFIX;
                $url = Options::get('siteurl')."/index.php?page=sitemap";
                $url = Options::get('siteurl')."/rss".GX_URL_PREFIX;
                $url = Options::get('siteurl')."/index.php?rss";
Fixed code: */

if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertgreen'] as $alert) {
        # code...
        echo "$alert\n";
    }
    echo "</div>";
}
if (isset($data['alertred'])) {
    # code...
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "$alert\n";
    }
    echo "</div>";
}
?>
                        if($c->parent == "" || $c->parent == 0){
                                  <a href=\"?page=categories&act=del&id={$c->id}&token=".TOKEN."\" class=\"pull-right\"
                                        <form action=\"index.php?page=categories\" method=\"POST\" name=\"updatecat\">
                                            <a href=\"?page=categories&act=del&id={$c2->id}&token=".TOKEN."\" class=\"input-group-addon\"
                                            <input type=\"hidden\" name=\"token\" value=\"".TOKEN."\">
                                    'parent' => '0',
            <input type="hidden" name="token" value="<?=TOKEN;?>">
*/

if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertgreen'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}elseif (isset($data['alertred'])) {
    # code...
    //print_r($data['alertred']);
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}
?>
                                              $data['parent'] = Menus::isHadParent('', $k);
            <input type="hidden" name="token" value="<?=TOKEN;?>">
if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertgreen'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}elseif (isset($data['alertred'])) {
    # code...
    //print_r($data['alertred']);
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}

<input type="hidden" name="token" value="<?=TOKEN;?>">
    if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertgreen'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}elseif (isset($data['alertred'])) {
    # code...
    //print_r($data['alertred']);
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}
            
                //print_r($data['menus']);
<input type="hidden" name="token" value="<?=$_GET['token'];?>">
if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertgreen'] as $alert) {
        echo "$alert\n";
    echo "</div>";
}
if (isset($data['alertred'])) {
    # code...
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertred'] as $alert) {
        echo "$alert\n";
    echo "</div>";
}
        <form action="" method="post">
            <div class="table-responsive">
                <table class="table table-hover">
                    <thead>
                        <tr>
                            <th>ID</th>
                            <th>Title</th>
                            <th>Date</th>
                            <th>Status</th>
                            <th>Edit/Delete</th>
                            <th>All <input type="checkbox" id="selectall"></th>
                        </tr>
                    </thead>
                    <tbody>
                        <?php
                            //print_r($data);
                        if($data['num'] > 0){
                            foreach ($data['posts'] as $p) {
                                # code...
                                //echo $p->id;
                                if($p->status == '0'){
                                    $status = "UnPublished";
                                }else{
                                    $status = "Published";
                                }
                                echo "
                                <tr>
                                    <td>{$p->id}</td>
                                    <td><a href=\"".Url::page($p->id)."\" target=\"_new\">{$p->title}</a></td>
                                    <td>{$p->date}</td>
                                    <td>{$status}</td>
                                    <td>
                                        <a href=\"index.php?page=pages&act=edit&id={$p->id}&token=".TOKEN."\" class=\"label label-success\">Edit</a> 
                                        <a href=\"index.php?page=pages&act=del&id={$p->id}&token=".TOKEN."\" class=\"label label-danger\" 
                                        onclick=\"return confirm('Are you sure you want to delete this item?');\">Delete</a>
                                    </td>
                                        <td>
                                        <input type=\"checkbox\" name=\"post_id[]\" value=\"{$p->id}\" id=\"select\">
                                    </td>
                                </tr>
                                ";
                            }
                        }else{
                                <tr>
                                        No Pages Found 
                                    </td>
                                </tr>";
                        ?>
                    </tbody>
                    <tfoot>
                        <th>ID</th>
                        <th>Title</th>
                        <th>Date</th>
                        <th>Status</th>
                        <th>
                        <select name="action" class="form-control">
                            <option value="publish">Publish</option>
                            <option value="unpublish">UnPublish</option>
                            <option value="delete">Delete</option>
                        </select>
                        <input type="hidden" name="token" value="<?=TOKEN;?>">
                        </th>
                        <th>
                            <button type="submit" name="doaction" class="btn btn-danger">
                                Submit
                            </button>
                        </th>
                    </tfoot>
                </table>
            </div>
        </form>
        

isset($_GET['token'])? $token = $_GET['token']: $token = TOKEN;
($_GET['act'] == "edit")? $pagetitle = "Edit": $pagetitle = "New";
($_GET['act'] == "edit")? $act = "edit&id={$_GET['id']}&token={$_GET['token']}": $act = "add";

if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    ";
    foreach ($data['alertgreen'] as $alert) {
        echo "$alert\n";
    }
    echo "</div>";
}

if (isset($data['alertred'])) {
    # code...
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "$alert\n";
    echo "</div>";
}
<form action="index.php?page=pages&act=<?=$act?>" method="post" role="form" class="">
<input type="hidden" name="token" value="<?=$token;?>">
                <th>Status</th>
                        if($p->status == '0'){
                            $status = "UnPublished";
                        }else{
                            $status = "Published";
                        }
                            <td>{$status}</td>
                                <a href=\"index.php?page=posts&act=edit&id={$p->id}&token=".TOKEN."\" class=\"label label-success\">Edit</a> 
                                <a href=\"index.php?page=posts&act=del&id={$p->id}&token=".TOKEN."\" class=\"label label-danger\" 
            <th>Status</th>
            <input type="hidden" name="token" value="<?=TOKEN;?>">
isset($_GET['token'])? $token = $_GET['token']: $token = TOKEN;
($_GET['act'] == "edit")? $pagetitle = "Edit": $pagetitle = "New";
($_GET['act'] == "edit")? $act = "edit&id={$_GET['id']}&token={$_GET['token']}": $act = "add";
if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertgreen'] as $alert) {
        echo "$alert\n";
    echo "</div>";
}
if (isset($data['alertred'])) {
    # code...
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertred'] as $alert) {
        echo "$alert\n";
    echo "</div>";
}
if(isset($data['post'])) {
    foreach ($data['post'] as $p) {
        # code...
        $title = $p->title;
        $content = $p->content;
        $date = $p->date;
        $status = $p->status;
        $cat = $p->cat;
    }
    if($status == 1) {
        $pub = "SELECTED"; 
        $unpub = ""; 
    }elseif ($status == 0) {
        $pub = ""; 
        $unpub = "SELECTED";
}else{
    $title = "";
    $content = "";
    $date = "";
    $status = "";
    $cat = "";
    $pub = "";
    $unpub = "";
}
<form action="index.php?page=posts&act=<?=$act?>" method="post" role="form" class="">
        <h1><i class="fa fa-file-text-o"></i> <?=$pagetitle;?> Post
<input type="hidden" name="token" value="<?=$token;?>">
*/

if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    ";
    foreach ($data['alertgreen'] as $alert) {
        # code...
        echo "$alert\n";
    }
    echo "</div>";
}

if (isset($data['alertred'])) {
    # code...
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "$alert\n";
    }
    echo "</div>";
}

?>
                          <input type="text" name="sitename" value="<?=Site::$name;?>" class="form-control">
                          <input type="text" name="sitedomain" value="<?=Site::$domain;?>" class="form-control">
                          <input type="text" name="siteurl" value="<?=Site::$url;?>" class="form-control">
                          <input type="text" name="sitekeywords" value="<?=Site::$key;?>" class="form-control">
                          <textarea  name="sitedesc" class="form-control"><?=Site::$desc;?></textarea>
                                $logoimg = "<img src=\"".Site::$url.Options::get('logo')."\" class=\"clearfix\">";
<input type="hidden" name="token" value="<?=TOKEN;?>">
                            <a href=\"index.php?page=users&act=edit&id={$p->id}&token=".TOKEN."\" class=\"label label-success\">Edit</a> 
                            <a href=\"index.php?page=users&act=del&id={$p->id}&token=".TOKEN."\" class=\"label label-danger\" 
                            onclick=\"return confirm('Are you sure you want to delete this?');\">Delete</a>
                    <input type="email" name="email" class="form-control">
          <input type="hidden" name="token" value="<?=TOKEN;?>">
if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertgreen'] as $alert) {
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}elseif (isset($data['alertred'])) {
    # code...
    //print_r($data['alertred']);
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertred'] as $alert) {
        echo "<li>$alert</li>\n";
    echo "</ul></div>";
}
<input type="hidden" name="token" value="<?=$_GET['token'];?>">
            }else{
                $sort = " ASC";
        //print_r($cat);
                if($c->parent == null || $c->parent == '0' ){
    public static function error ($vars="", $val='') {
            include(GX_PATH.'/inc/lib/Control/Error/unknown.control.php');
        if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
            // VALIDATE ALL
            $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
        }
        if(isset($alertred)){
            $data['alertred'] = $alertred;
        }else{
            $slug = Typo::slugify(Typo::cleanX($_POST['cat']));
            $cat = Typo::cleanX($_POST['cat']);
            $cat = Db::insert(
                        sprintf("INSERT INTO `cat` VALUES (null, '%s', '%s', '%d', '' )", 
                            $cat, $slug, $_POST['parent']
                        )
                    );
            //print_r($cat);
            $data['alertgreen'][] = "Category Added: ".$_POST['cat'];
        }
        if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
            // VALIDATE ALL
            $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
        }
        if(isset($alertred)){
            $data['alertred'] = $alertred;
        }else{
            $vars = array(
                        'table' => 'cat',
                        'id' => $_POST['id'],
                        'key' => array(
                                    'name' => Typo::cleanX($_POST['cat'])
                                )
                    );
            $cat = Db::update($vars);
            $data['alertgreen'][] = "Category Updated: ".$_POST['cat'];
        }
    if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
        // VALIDATE ALL
        $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
    }
    if(isset($alertred)){
        $data['alertred'] = $alertred;
    }else{
        Categories::delete($_GET['id']);
        $data['alertgreen'][] = "Category Removed";
    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    $menus = Options::get('menus');
                    $menus = json_decode(Options::get('menus'), true);
                   //echo "<pre>"; print_r($menus); echo "</pre>";
                    // $menu = array(
                    //                 $_POST['id']  =>  array(
                    //                             'name' => $menus[$_POST['id']]['name'],
                    //                             'class' => $menus[$_POST['id']]['class'],
                    //                             'menu' => array(
                    //                                     'parent' => $_POST['parent'],
                    //                                     'menuid' => $_POST['id'],
                    //                                     'type' => $_POST['type'],
                    //                                     'value' => $_POST[$_POST['type']]
                    //                                 )
                    //                         )
                    //                 );
                    
                    // if(is_array($menus)){
                    //     $menu = array_merge($menus, $menu);
                    // }
                    // echo "<pre>"; print_r($menu); echo "</pre>";
                    //$menu = $menus;
                    $menu[$_POST['id']]['menu'] = $menus[$_POST['id']]['menu'];
                    $menu[$_POST['id']]['menu'][] = array(
                                                        'parent' => $_POST['parent'],
                                                        'menuid' => $_POST['id'],
                                                        'name' => Typo::cleanX($_POST['name']),
                                                        'type' => $_POST['type'],
                                                        'value' => $_POST[$_POST['type']],
                                                        'sub' => ''
                                                    );
                     $menu = array(
                                    $_POST['id']  =>  array(
                                                'name' => $menus[$_POST['id']]['name'],
                                                'class' => $menus[$_POST['id']]['class'],
                                                'menu' => $menu[$_POST['id']]['menu']    
                                            )
                                    );
                    if(is_array($menus)){
                        $menu = array_merge($menus, $menu);
                    }
                    //echo "<pre>"; print_r($menu); echo "</pre>";
                    $menu = json_encode($menu);
                    //echo "<pre>"; print_r($menu); echo "</pre>";
                    //Options::update('menus', $menu);

                    $vars = array(
                                'parent' => $_POST['parent'],
                                'menuid' => $_POST['id'],
                                'name' => Typo::cleanX($_POST['name']),
                                'class' => Typo::cleanX($_POST['class']),
                                'type' => $_POST['type'],
                                'value' => $_POST[$_POST['type']]
                            );
                    Menus::insert($vars);
                    $data['alertgreen'][] = 'Menu Added';
        $data['parent'] = Menus::isHadParent('', $menuid);
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    $vars = array(
                                'parent' => $_POST['parent'],
                                'menuid' => $_POST['id'],
                                'name' => Typo::cleanX($_POST['name']),
                                'class' => Typo::cleanX($_POST['class']),
                                'type' => $_POST['type'],
                                'value' => $_POST[$_POST['type']]
                            );
                    $vars = array(
                                'id' => $_GET['itemid'],
                                'key' => $vars
                            );
                    Menus::update($vars);
                    $data['alertgreen'][] = 'Menu Updated';
                }
        $data['parent'] = Menus::isHadParent('', $menuid);
            if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
                // VALIDATE ALL
                $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
            }
            if(isset($alertred)){
                $data['alertred'] = $alertred;
            }else{
                Menus::delete($_GET['itemid']);
                $data['alertgreen'][] = 'Menu Deleted';
            }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    $menu = array(
                                    $_POST['id']  =>  array(
                                                'name' => Typo::cleanX($_POST['name']),
                                                'class' => Typo::cleanX($_POST['class']),
                                                'menu' => array()
                                            )
                                    );
                    $menus = json_decode(Options::get('menus'), true);
                    if(is_array($menus)){
                        $menu = array_merge($menus, $menu);
                    }
                    
                    $menu = json_encode($menu);
                    Options::update('menus', $menu);
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    $vars = array(
                                'parent' => $_POST['parent'],
                                'menuid' => $_POST['id'],
                                'name' => Typo::cleanX($_POST['name']),
                                'class' => Typo::cleanX($_POST['class']),
                                'type' => $_POST['type'],
                                'value' => $_POST[$_POST['type']]
                            );
                    Menus::insert($vars);
                    $data['alertgreen'][] = 'Menu Item Added';
                }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    Menus::updateMenuOrder($_POST['order']);
                    $data['alertgreen'][] = 'Menu Order Changed';
                }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                    if (!isset($_POST['date']) || $_POST['date'] == "") {
                        # code...
                        $date = date("Y-m-d H:i:s");
                    }else{
                        $date = $_POST['date'];
                    }
                    $vars = array(
                                    'title' => Typo::cleanX($_POST['title']),
                                    'content' => Typo::cleanX($_POST['content']),
                                    'date' => $date,
                                    'type' => 'page',
                                    'author' => Session::val('username'),
                                    'status' => $_POST['status'],
                                );
                    //print_r($vars);
                    Posts::insert($vars);
                    $data['alertgreen'][] = "Page : {$_POST['title']} Added.";
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                    if (!isset($_POST['date']) || $_POST['date'] == "") {
                        # code...
                        $date = date("Y-m-d H:i:s");
                    }else{
                        $date = $_POST['date'];
                    }
                    $moddate = date("Y-m-d H:i:s");
                    $vars = array(
                                    'title' => Typo::cleanX($_POST['title']),
                                    'content' => Typo::cleanX($_POST['content']),
                                    'modified' => $moddate,
                                    'date' => $date,
                                    'status' => $_POST['status'],
                                );
                    //print_r($vars);
                    Posts::update($vars);
                    $data['alertgreen'][] = "Page : {$_POST['title']} Updated.";
                if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    $del = Posts::delete($_GET['id']);
                }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::publish($id);
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::unpublish($id);
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::delete($id);
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                    if (!isset($_POST['date']) || $_POST['date'] == "") {
                        # code...
                        $date = date("Y-m-d H:i:s");
                    }else{
                        $date = $_POST['date'];
                    }
                    $vars = array(
                                    'title' => Typo::cleanX($_POST['title']),
                                    'cat' => $_POST['cat'],
                                    'content' => Typo::cleanX($_POST['content']),
                                    'date' => $date,
                                    'type' => 'post',
                                    'author' => Session::val('username'),
                                    'status' => $_POST['status'],
                                );
                    //print_r($vars);
                    Posts::insert($vars);
                    $data['alertgreen'][] = "Post : {$_POST['title']} Added.";
                    
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if (isset($alertred)) {
                    # code...
                    $data['alertred'] = $alertred;
                }else{
                    $moddate = date("Y-m-d H:i:s");
                    $vars = array(
                                    'title' => Typo::cleanX($_POST['title']),
                                    'cat' => $_POST['cat'],
                                    'content' => Typo::cleanX($_POST['content']),
                                    'modified' => $moddate,
                                    'date' => $_POST['date'],
                                    'status' => $_POST['status'],
                                );
                    //print_r($vars);
                    
                    Posts::update($vars);
                    $data['alertgreen'][] = "Post : <b>{$_POST['title']}</b> Updated.";
                }
                if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if (isset($alertred)) {
                    # code...
                    $data['alertred'] = $alertred;

                    $title = Posts::title($_GET['id']);
                    $del = Posts::delete($_GET['id']);
                    //echo $title['error'];
                    if(isset($del['error'])){
                        $data['alertred'][] = $del['error'];
                    }else{
                        $data['alertgreen'][] = 'Post <b>'.$title.'</b> Removed';
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if (isset($alertred)) {
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::publish($id);
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if (isset($alertred)) {
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::unpublish($id);
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if (isset($alertred)) {
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::delete($id);
                    }
$data = "";
        if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
            // VALIDATE ALL
            $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
        }
        if(isset($alertred)){
            $data['alertred'] = $alertred;
        }else{
            $vars = array();
            if(isset($_FILES['logo']) && $_FILES['logo'] != ''){
                $path = "/assets/images/";
                $allowed = array('png', 'jpg', 'gif');
                $upload = Upload::go('logo', $path, $allowed );
                if(isset($upload['error']) != ''){
                    echo $upload['error'];
                }else{
                    $vars['logo'] = $upload['path'];
                }
                unset($_POST['logo']);
            
            
            //print_r($_POST);
            $flip = array_flip($_POST);
            $sql = "SELECT * FROM `options` WHERE `value` = 'on'";        
            $q = Db::result($sql);
            foreach($q as $ob) {
                if( isset( $flip[$ob->name] ) ) {
                    $vars[$ob->name] = 'on';
                    //echo $ob->name;
                }else{
                    $vars[$ob->name] = 'off';
                    //echo $ob->name;
                }
            //print_r($ob);
            foreach ($_POST as $key => $val) {
                # code...
                $vars[$key] = $val;
            }
            unset($vars['change']);
            //print_r($vars);
            Options::update($vars);
            $data['alertgreen'][] = "New Settings Saved.";
System::inc('settings',$data);
                //check token first 
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                
                
                if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
                    // VALIDATE ALL
                    $data['alertred'][] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }else{
                    User::delete($_GET['id']);
                    $data['alertgreen'][] = "User : ".$user." Removed";
                }
                
                // CHECK TOKEN FIRST 
                //echo Token::isExist($_POST['token']);
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                    Token::remove(TOKEN);

<h2>Database Error</h2>
Something went wrong with the database.<br />
<span style="border-radius: 7px; border: 3px solid #cc0000; line-height: 35px; 
height: 50px; background-color: #aa0000; color: #fff; padding: 5px;">
<?php
echo $val;
?>
</span>
<h2>Unknown Error Occured</h2>
<?php if(isset($val)) {?>
<div class="alert alert-danger">
<?=$val;?>
</div>

<?php
    }
    Site::footer();
?>
                            AND `status` = '1'
    Theme::theme('header',$data);
    exit;
    exit;
                            AND `status` = '1'
Theme::theme('header',$data);
        exit;
                                    WHERE (`id` = '%d' OR `slug` = '%s')
                                    AND `status` = '1'
                                    Typo::cleanX($page)
            Theme::theme('header',$data);
            exit;
            exit;
                            WHERE `id` = '%d' 
                            AND `type` = 'post'
                            AND `status` = '1' 
                            LIMIT 1",
    Theme::theme('header',$data);
    exit;
    exit;
                <br>
            try {
                self::$mysqli = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
                if (self::$mysqli->connect_error) {
                    Control::error('db', self::$mysqli->connect_error);
                    exit;
                }else{
                    return true;
                }
            } catch (exception $e) {
                Control::error('db', $e->getMessage() );
            }
            
            //return self::$mysqli;
                Control::error('db',"Query failed: ".self::$mysqli->error."<br />\n"); 
                    // printf("<div class=\"alert alert-danger\">Errormessage: %s</div>\n", self::$mysqli->error);
                    //Control::error('db',self::$mysqli->error);
            new Site();
            Token::create();
*/error_reporting(0);








// DON't REMOVE or EDIT THIS.
                  `fname` varchar(32) COLLATE latin1_general_ci NULL,
            (null, 'ppsign', ''),
            (null, 'tokens', '')";
    public function __construct()
/**
* GeniXCMS - Content Management System
* 
* PHP Based Content Management System and Framework
*
* @package GeniXCMS
* @since 0.0.1 build date 20141007
* @version 0.0.1
* @link https://github.com/semplon/GeniXCMS
* @author Puguh Wijayanto (www.metalgenix.com)
* @copyright 2014-2015 Puguh Wijayanto
* @license http://www.opensource.org/licenses/mit-license.php MIT
*
*/

/**
* Menus Class.
* This class is for managing the menu at the dasboard. 
*
* @author Puguh Wijayanto (www.metalgenix.com)
* @since 0.0.1
    /**
    * Menus Constructor.
    * Nothing to construct
    * @since 0.0.1
    *
    */

    /**
    * isHadParent Function
    * 
    * This function is to get the list of parent in certain conditions. There are 
    * two paramaters to be inserted. 
    * @param int $parent
    * @param string $menuid
    * 
    * @author Puguh Wijayanto (www.metalgenix.com)
    * @since 0.0.1
    */
    public static function isHadParent($parent='', $menuid = ''){
        if(isset($parent)){
            $parent = " `parent` = '{$parent}'";
        }else{
            $parent = '1';
        }
        $sql = sprintf("SELECT * FROM `menus` WHERE %s %s", $parent, $where);
    public static function getParent($id){
        $q = self::getId($id);
        return $q[0]->parent;
                    $parent = self::isHadParent($m->id, $menuid);
                                    $parent = self::isHadParent($m2->id, $menuid);
                                                    $parent = self::isHadParent($m3->id, $menuid);
                                                                    $parent = self::isHadParent($m4->id, $menuid);
                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m->id}&token=".TOKEN."\" class=\"label label-danger pull-right\" >
                    $parent = self::isHadParent($m->id, $menuid);
                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m2->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m2->id}&token=".TOKEN."\" class=\"label label-danger pull-right\" >
                                        $parent = self::isHadParent($m2->id, $menuid);
                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m3->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m3->id}&token=".TOKEN."\" class=\"label label-danger pull-right\" >
                                                        $parent = self::isHadParent($m3->id, $menuid);
                                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m4->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m4->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
            $sql = sprintf("SELECT * FROM `menus` WHERE `id` = '%d'", $id);
    //             'name' => '',
    //             'value' => ''
                        'name' => $vars['name'],
                        'value' => $vars['value']
            $opt = Db::insert($ins);
        }else{
            Control::error('unknown','Format not Found, please in array');
        return $opt;
        $sql = "SELECT * FROM `posts` WHERE `type` = '{$type}' AND `status` = '1' ORDER BY `date` DESC LIMIT {$vars}";
            $where = "WHERE `status` = '1' AND ";
                    <title>".Site::$name."</title>
                    <link>".Site::$url."</link>
                    <description>".Site::$desc."</description>
    static $url;
    static $domain;
    static $name;
    static $key;
    static $desc;
        self::$url = Options::get('siteurl');
        self::$domain = Options::get('sitedomain');
        self::$name = Options::get('sitename');
        self::$key = Options::get('sitekeywords');
        self::$desc = Options::get('sitedesc');
            $sitenamelength = strlen(self::$name);
    <title>{$cont_title}".self::$name."</title>
    <meta name=\"Keyword\" content=\"".self::$key."\">
    <link href=\"".self::$url."/assets/css/bootstrap.min.css\" rel=\"stylesheet\">\n";
            \t<script src=\"".self::$url."/assets/js/bootstrap.min.js\"></script>
            \t<script src=\"".self::$url."/assets/js/ie10-viewport-bug-workaround.js\"></script>";
            \t<link href=\"".self::$url."/assets/css/summernote.css\" rel=\"stylesheet\">
            \t<script src=\"".self::$url."/assets/js/summernote.min.js\"></script>
            \t<script src=\"".self::$url."/assets/js/plugins/summernote-ext-fontstyle.js\"></script>
            \t<script src=\"".self::$url."/assets/js/plugins/summernote-ext-hello.js\"></script>
            \t<script src=\"".self::$url."/assets/js/plugins/summernote-ext-video.js\"></script>
            \t<link href=\"".self::$url."/assets/css/bootstrapValidator.min.css\" rel=\"stylesheet\">
            \t<script src=\"".self::$url."/assets/js/bootstrapValidator.min.js\"></script>
            $desc = substr(strip_tags(htmlspecialchars_decode($vars).". ".self::$desc),0,150);
            $desc = substr(self::$desc,0,150);
            $logo = "<img src=\"".self::$url.Options::get('logourl')."\"
            $logo = "<img src=\"".self::$url.Options::get('logo')."\"
    /** 
    * GeniXCMS Version Variable 
    * @return double
    */

    /** 
    * GeniXCMS Version Release 
    * @return string
    */
    /**
    * System Constructor.
    * Initializing the system, check the config file, if exist run the config
    * loader. 
    * @author Puguh Wijayanto (www.metalgenix.com)
    * @since 0.0.1
    */
            self::lang(GX_LANG);            
    /**
    * System Library Loader.
    * This will include library which is called.
    * @author Puguh Wijayanto (www.metalgenix.com)
    * @since 0.0.1
    */
/* Location: ./inc/lib/system.class.php */
<?php
/**
* GeniXCMS - Content Management System
* 
* PHP Based Content Management System and Framework
*
* @package GeniXCMS
* @since 0.0.2 build date 20150309
* @version 0.0.2
* @link https://github.com/semplon/GeniXCMS
* @author Puguh Wijayanto (www.metalgenix.com)
* @copyright 2014-2015 Puguh Wijayanto
* @license http://www.opensource.org/licenses/mit-license.php MIT
*
*/


/**
* Token Class
*
* @author Puguh Wijayanto (www.metalgenix.com)
* @since 0.0.2
*/
class Token
{
    public function __construct () {

    }

    public static function create() {
        self::ridOld();
        $length = "80";
        $token = "";
        $codeAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
        $codeAlphabet.= "abcdefghijklmnopqrstuvwxyz";
        $codeAlphabet.= "0123456789";
        $codeAlphabet.= SECURITY;
        for($i=0;$i<$length;$i++){
            $token .= $codeAlphabet[Typo::crypto_rand_secure(0,strlen($codeAlphabet))];
        }
        $url = $_SERVER['REQUEST_URI'];
        $url = htmlspecialchars($url, ENT_QUOTES, 'UTF-8');
        $ip = $_SERVER['REMOTE_ADDR'];
        $time = time();
        define('TOKEN', $token);
        define('TOKEN_URL', $url);
        define('TOKEN_IP', $ip);
        define('TOKEN_TIME', $time);
        $json = self::json();
        Options::update('tokens',$json);
        return $token;
    }

    /**
    * Json Token Function
    *
    * $token = [{'time','ip','url',token'},]
    */
    public static function json() {
        $token = Options::get('tokens');
        $token = json_decode($token, true);
        $newtoken = array(
                        TOKEN => array(
                            'time' => TOKEN_TIME,
                            'ip' => TOKEN_IP,
                            'url' => TOKEN_URL
                            )
                    );
        if(is_array($token)){
            $newtoken = array_merge($token, $newtoken);
        }

        $newtoken = json_encode($newtoken);
        return $newtoken;
    }

    public static function isExist($token){
        $json = Options::get('tokens');
        $tokens = json_decode($json, true);
        if(array_key_exists($token, $tokens)){
            $call = true;
        }else{
            $call = false;
        }
        return $call;
    }

    public static function remove($token){
        $json = Options::get('tokens');
        $tokens = json_decode($json, true);
        unset($tokens[$token]);
        $tokens = json_encode($tokens);
        if(Options::update('tokens',$tokens)){
            return true;
        }else{
            return false;
        }
    }

    public static function ridOld() {
        $json = Options::get('tokens');
        $tokens = json_decode($json, true);
        $time = time();
        foreach ($tokens as $token => $value) {
            # code...
            //print_r($token);
            if ($time - $value['time'] > 600) {
                # code...
                unset($tokens[$token]);
            }
        }
        $tokens = json_encode($tokens);
        if(Options::update('tokens',$tokens)){
            return true;
        }else{
            return false;
        }
    }
}
                    $result['fileurl'] = Site::$url.$path.$uniqfile.$filename;
                $url = Site::$url."/".self::slug($vars)."/{$vars}";
                $url = Site::$url."/index.php?post={$vars}";
                $url = Site::$url."/".self::slug($vars).GX_URL_PREFIX;
                $url = Site::$url."/index.php?page={$vars}";
                $url = Site::$url."/".$vars."/".Typo::slugify(Categories::name($vars));
                $url = Site::$url."/index.php?cat={$vars}";
                $url = Site::$url."/sitemap".GX_URL_PREFIX;
                $url = Site::$url."/index.php?page=sitemap";
                $url = Site::$url."/rss".GX_URL_PREFIX;
                $url = Site::$url."/index.php?rss";