Green Submissions

Introduction

Green Submissions is a complete, self-hosted submission manager for literary journals, magazines, and small presses. It gives writers a clean place to send work and follow its progress, and gives your editorial staff a private suite for reading, rating, deciding, collaborating on revisions, running contests, and communicating with contributors.

It is battle-tested software: the same codebase has run a working literary journal continuously since 2010, and this release carries all of that refinement — modern security, PayPal contest fees, blind reading, volunteer readers, and more.

It is distributed as free shareware. You may use it for any purpose, including commercial publishing, at no cost. The only requirement is that the footer credit line — "Submission Manager by Glenn Lyvers, provided freely through greensubmissions.com" — remains visible with its link active. See Appendix D.

How this guide is organized

• Part I gets the software installed and configured — written for a site owner with no special technical background.
• Part II is the writer's guide — you can copy from it freely for your own help pages.
• Part III covers every tool in the Editorial Suite, role by role.

1. Choosing a host Install

Green Submissions runs on ordinary PHP + MySQL hosting — the most common, least expensive kind of hosting there is. You do not need a VPS, a "managed application" plan, or anything exotic. Any cPanel-style shared account that meets the requirements will do.

Where to put it

Two common layouts, both fully supported:

2. Server requirements Install

The web installer checks every one of these automatically on its first screen, so you don't need to verify them by hand.

3. Preparing your server Install

Step A — Create the database

1. In cPanel, open MySQL® Databases.
2. Create a new database (e.g. myacct_submissions).
3. Create a new database user with a strong password.
4. Add the user to the database and grant ALL PRIVILEGES.
5. Write down all three values: database name, user name, password. The installer will ask for them.

Step B — Upload the files

1. Upload the release ZIP with cPanel's File Manager (or FTP/SFTP) to the folder you chose in section 1.
2. Extract it there so that index.php, styles.css, and the editors/ folder sit directly in your target folder.
3. Confirm folder permissions are 755 (the cPanel default). Nothing needs to be 777.

Step C — Have your SMTP details ready

Create a mailbox such as [email protected] in cPanel → Email Accounts, and note the SMTP host (usually mail.yourjournal.com), port (usually 465 with SSL), username (the full email address), and password. You'll enter these in the Editorial Suite right after installing.

4. The web installer Install

Visit your upload folder in a browser — e.g. https://yourjournal.com/submit/. Because no config.php exists yet, you are redirected to the installer automatically. Four screens:

Screen 1 — Requirements check

Every requirement from section 2 is tested live, plus write-permission checks on the app folder, /attachments, and guidelines_content.html. Anything marked ✗ FAILED must be fixed before continuing (the screen tells you how). On a properly configured host — such as instantaccess.net — everything passes on the first load.

Screen 2 — Database & site identity

On submit, the installer connects to your database, creates all tables with sensible seed settings, and writes config.php. Errors (wrong password, no privileges, etc.) are shown in plain language so you can correct and retry.

Screen 3 — First administrator

Create your own staff account. It receives the Super Administrator role — full access to everything, including staff management. The password must be at least 8 characters with upper- and lowercase letters and a number. This screen only works while the staff table is empty; it can never be used to add accounts to a live site.

Screen 4 — Finished

You get links to your public site and the Editorial Suite, plus the first-run checklist (section 6).

5. Manual installation Install

Prefer to do it by hand, or installing on a server without a browser-reachable installer? Three steps:

1. Import the schema. In phpMyAdmin, select your empty database → Import → choose install/schema.sql. This creates all tables and seed settings.
2. Create the config. Copy config-sample.php to config.php and fill in the database credentials and site identity variables. Every field is commented.
3. Create the first admin. Either open /install/index.php?step=3 in a browser (it works as long as the staff table is empty), or insert a row into sm_editors yourself with user_type = 'superadmin' and a password generated by PHP's password_hash().

Then delete /install and continue with the first-run checklist.

6. First-run checklist Install

Log in to the Editorial Suite at /editors/login.php and work through these in order:

1. SMTP — enter your outgoing-mail settings and use Send Test Email to confirm they work. Nothing else matters until mail flows: signups can't be confirmed without it. (Section 34.)
2. Editions — create your first edition (e.g. Spring 2027) and tick Open for Submissions. Writers cannot submit until at least one edition is open. (Section 27.)
3. Guidelines — replace the placeholder guidelines with your own. Writers must agree to them at signup and again at every submission. (Section 36.)
4. Settings — review the toggles: blind reading, withdrawals, downloads, allowed file types, slush-pile columns, notification emails. (Section 33.)
5. PayPal (optional) — if you'll run paid contests, configure sandbox credentials, test, then switch to live. (Section 35.)
6. Staff — add your editors and admins. (Section 31.)
7. Test the writer journey yourself — sign up with a personal email, confirm, submit a test piece, then log back into the Suite and decide it. Five minutes, total confidence.

7. Security notes Install

Security is engineered in, not bolted on. What ships enabled, and what you should do on top:

Built in — nothing to configure

• Every database query uses PDO prepared statements — no string-built SQL anywhere.
• Passwords stored with password_hash() (bcrypt); never in plain text, never recoverable.
• CSRF tokens on every form; sessions regenerated at login to defeat fixation.
• Hardened session cookies: HttpOnly, SameSite=Lax, Secure on HTTPS.
• Bot protection on login, signup, and password reset — Turnstile or image captcha.
• The /attachments folder refuses to execute any script type; uploads can only ever be downloaded.
• config.php, config-sample.php, and paypal_config.php are blocked from direct web access.
• Password-reset and email-change tokens are single-use, random, and time-limited.
• Writer bios pass through a strict server-side HTML whitelist — no scripts, no links to malware, no XSS.
• PayPal payments are verified server-to-server; the browser is never trusted to claim a payment happened.

Your part

• Delete /install after installing.
• Use HTTPS. Free on virtually every host; mandatory if you take payments.
• Back up the database and /attachments on a schedule (cPanel backups or your host's tools — instantaccess.net plans include this).
• Optionally rename the /editors/ folder to something private. All its internal links are relative, so only one line in editors/forgot-password.php (the reset-link path) needs updating afterward.
• Keep PHP current — when your host offers a newer PHP 8.x, switch to it.

8. Upgrading Install

1. Back up the database and the whole app folder.
2. Upload the new release over the old files, keeping your config.php, paypal_config.php, guidelines_content.html, and the entire /attachments folder.
3. Run any SQL migration listed in the release notes (phpMyAdmin → SQL tab).
4. Delete the new /install folder.

9. Troubleshooting Install

Still stuck? Your host's support is the fastest path for server-level issues — one more reason to use a host that already runs this software, like instantaccess.net. Bugs in the software itself can be reported through greensubmissions.com.

10. Creating an account Writers

Everything below describes what your writers see. Feel free to copy any of it into your own FAQ or help page.

1. From the home page, choose Create an Account (or Sign Up in the menu).
2. Enter first name, last name, email address, and a password — that's the whole form. Passwords must be at least 8 characters and include an uppercase letter, a lowercase letter, a number, and a special character.
3. Complete the human-verification check (an invisible Cloudflare widget, or a short image code, depending on how the site is configured).
4. Tick the box agreeing to the submission guidelines (linked right there — read them!).
5. Check your inbox for the confirmation email and click its link. You cannot log in until you confirm. No email after a few minutes? Check spam, then contact the editors — they can confirm you manually.

11. Signing in & passwords Writers

Sign in with your email and password at the Login page. Sessions are secure and private; use Logout in the member menu when you're on a shared computer.

Forgot your password?

1. Click Forgot your password? on the login page.
2. Enter your email and pass the verification check. If the address is on file, a reset link arrives by email (valid for 1 hour, single use).
3. Choose a new password meeting the same strength rules. As a bonus, completing a reset also confirms your email if it was never confirmed.

12. The dashboard Writers

After signing in you land on Your Account Manager. It shows:

• Status notifications — a card for every submission whose status changed since you last checked, including any note the editor attached. Click Remove this Notification once you've read it.
• Submission credits — if the editors have granted you contest-fee credits, a banner shows your balance (see section 14).
• An acceptance message — when work of yours is accepted, the journal's congratulation note appears here once.

The member menu links to Guidelines, Submit (only while an edition is open), My Submissions, My Biography, My Profile, and Logout. When nothing is open for submissions, the menu says so instead of showing a Submit link.

13. Submitting work Writers

1. Choose Submit from the member menu.
2. Pick an edition. Regular issues are free; contests show their entry fee right in the list. Selecting a contest reveals its full description and the payment box.
3. Enter a title.
4. Attach your file. One attachment per submission; the accepted file types are listed under the field (set by the editors — commonly .doc, .docx, .txt).
5. Optional comments — a cover-note box for anything you want the editors to know.
6. Tick the guidelines agreement and press Submit.

For contest editions you'll also choose how to pay before submitting — see the next section.

14. Contest fees & credits Writers

Contests carry an entry fee. Two ways to cover it:

Submission credits

Editors can grant fee-waiver credits to your account (prizes, hardship waivers, promotions — their call). If you have any, the payment box offers Use 1 submission credit, which covers the full fee instantly. Your balance shows on the dashboard.

PayPal

1. Select Pay with PayPal and press Submit. Your entry is stored as pending and you're taken to PayPal's secure checkout (card payments work there too — no PayPal account needed).
2. Approve the payment and you're returned to the site. The system verifies the payment directly with PayPal before your entry is accepted — the confirmation page will say "Payment received — your contest entry has been submitted."
3. Cancel at PayPal and nothing is charged or submitted; your uploaded file is discarded and you can try again anytime.

15. Tracking submissions Writers

My Submissions lists everything you've sent: date, title, current status, and edition. Statuses you may see:

Row options

• WITHDRAW — instantly withdraw a pending submission yourself, no email needed (if the journal has this enabled). Once accepted, contact the editors instead.
• DOWNLOAD — re-download the file you sent (if enabled).
• REVISION TOOL — appears when revisions are requested, with a note of who replied last.
• Clicking a title shows the full submission record, including the cover comments you sent.

16. Revision collaboration Writers

When editors set your piece to Revision Requested, the Revision Tool opens a private message thread between you and the editorial team, attached to that specific submission:

• A banner always tells you whose turn it is — "Waiting for Your Response (your turn)" or "Waiting for Editor's Response."
• Write a message, attach a revised file, or both. The same file-type rules apply as for submissions.
• The most recent message is shown prominently; expand View Full Message History for the whole thread, color-coded by sender.

Everything stays in one place — no digging through email chains to find draft three.

17. Your biography Writers

My Biography is the text that appears on the journal's public Contributors page once you have accepted work. The editor supports bold, italic, underline, and bullet/numbered lists — nothing else, by design — with a live character counter (2,000 visible characters max) and a live preview showing exactly how your entry will look. If you paste something over the limit, your draft is preserved so you can trim it without losing work.

18. Your profile Writers

• Pen name — set one and it's used everywhere public (directory, editor screens show both). Leave blank to publish under your real name.
• Contributors-page listing — untick List me on the public Contributors page to keep your name and bio out of the public directory. Your published work is unaffected.
• Email change (two-step, secure) — click Change My Email Address, enter the new address, and save. A confirmation link goes to the new address; your sign-in email does not change until you click it (link valid 1 hour). A pending change can be cancelled from the profile at any time. Keep this address current — it's where all notices go.

19. Contributor directory Writers

The public Contributors page lists everyone with accepted work who hasn't opted out — searchable by name, paginated, displayed in elegant newspaper columns. Clicking a name opens the contributor's biography in a pop-over without leaving the page. Pen names are respected throughout.

20. Becoming a volunteer reader Writers

If the journal has volunteer reading enabled, a Staff Reader signup link appears in the footer. Applicants provide contact details, agree to the reader guidelines, and pass a captcha; the application lands in a queue for an administrator to approve. Approved readers get a staff login to the Readers Area (section 32) where they score pending submissions to help editors prioritize.

21. Staff login & roles Editors

The Editorial Suite lives at /editors/login.php — a completely separate login from writer accounts. Staff password resets are available on the same page (secure emailed link, single-use).

Each role inherits the tools of the roles below it. The nav shows only what your role permits.

22. The admin dashboard Editors

The Suite home page gives administrators four quick tools:

• Manually confirm an email — for the writer whose confirmation email got eaten by a spam filter. Enter their address; done.
• Accepted message — the congratulation text shown once on a writer's dashboard when you accept their work.
• Custom statuses — add your own statuses beyond Accepted / Rejected / Revision Requested (e.g. Shortlisted, Winner, Hold for Next Issue). Edit or delete them here too; deleting a status returns any submissions using it to Pending.
• Notification settings — turn on email alerts for new submissions and list the staff addresses (comma-separated) that should receive them.

23. The slush pile Editors

The heart of the Suite: every pending submission in one sortable table.

• Priority first: paid contest entries (badged PAID) float to the top and are row-highlighted; everything else follows in your chosen sort order.
• Sortable columns: date, title, contributor, type, email, edition — click a header to sort, click again to flip. Optional columns (toggled in Settings): average reader score, IP address, and payment type.
• Contributor links: the name links to that writer's full User History (every submission they've ever sent); the email is a one-click mailto.
• Bulk move: tick any set of rows and move them to a different edition in one action — perfect for rolling unread work into the next issue at deadline.
• Blind mode: flip Blind Editor Mode in Settings and editors get an identity-free slush pile (and, if configured, contributor cover comments are hidden too) for genuinely anonymous reading. A parallel blind contest view exists for contests.

24. Reviewing a submission Editors

Click a title to open the full submission view:

• Title, edition, current status, and the writer's cover comments (hidden in blind mode).
• Download the attachment via a protected download endpoint (files can never execute on the server).
• Private editorial notes — a running note thread on the piece, visible to staff only, each entry stamped with author and date. Readers can contribute notes too if Reader Notes is enabled.
• Reader scores for the piece, where volunteer readers are in use.
• A direct link to Update Status (next section).

25. Statuses & decisions Editors

The Update Status screen is where decisions happen:

1. Choose the new status — Accepted, Rejected, Revision Requested, or any custom status you've defined.
2. Optionally attach a note to the writer — personalized feedback, next steps, congratulations.
3. Save. The system records the change in the submission's history, queues the notification on the writer's dashboard, and emails the writer automatically ("the status of your submission has been updated — log in to view"), including a login link.

Accepting a piece also triggers the journal's accepted message on the writer's dashboard. Every status change is tracked with previous → new status, editor, timestamp, and note, so the full decision history of any piece is auditable.

Dedicated list pages keep the archive organized: Accepted, Rejected, Other (custom statuses), and Search (find anything by contributor name and/or title, across all statuses).

26. Requesting revisions Editors

Set a submission to Revision Requested and the collaboration thread opens for both sides:

• Use Collaborate on the submission to send messages and attach files (marked-up drafts, style sheets, whatever helps).
• The writer gets the same thread from their side, with clear your-turn/their-turn signals.
• Revisions in Progress lists every piece currently in revision, sorted by the latest activity, so nothing stalls silently.
• When the revision satisfies you, simply update the status to Accepted (or anything else) — the thread stays on record.

27. Editions & contests Editors

An edition is anything writers submit to: an issue, a themed folio, or a contest. On the Editions page (admins):

• Create an edition with a name and a rich description.
• Open / close it with the Open for Submissions checkbox. Multiple editions can be open at once — writers pick from a dropdown. When nothing is open, the public site says "Submissions are currently closed."
• Make it a contest by ticking This is a contest and setting the entry fee. Contest editions display their description and fee to writers at submission time and require payment (credit or PayPal) before entry.
• The list shows open and closed editions separately with type, fee, date added, status, and a live count of accepted pieces.
• Delete removes an edition and every submission under it — the big red warning means it.

Contest entries also appear in the dedicated Contest tab (toggleable in Settings), including a blind variant for anonymous contest judging.

28. Submission credits Editors

Credits are fee waivers writers can spend on contest entries — one credit covers one full entry fee. Admin-only, on the Credits page:

• Search any writer by name, pen name, email, or ID.
• Grant (or deduct) 1–100 credits with a required reason — every movement is written to a permanent audit ledger showing date, amount, reason, and which admin did it.
• The writer's current balance and recent history display right in the search result.
• When a writer spends a credit, the ledger records which submission consumed it, automatically.

Typical uses: contest prizes ("three free entries next year"), hardship waivers, promotions, make-goods.

29. Contributors admin Editors

The Contributors page (admins) manages the public directory:

• Toggle any writer's visibility on the public Contributors page (the writer controls this from their profile too — either side can hide a listing).
• Edit or clean up a contributor's biography; the same strict HTML whitelist is applied on save, so nothing unsafe can be stored regardless of what's pasted.

30. The mail center Editors

Send email to your writers, straight from the Suite (admins):

Messages support mail-merge variables — [firstname], [lastname], [email] — personalized per recipient. After sending you get an explicit per-recipient delivered/failed report. All mail goes through your configured SMTP account.

31. Managing staff Editors

The Staff page (super administrators only):

• Add staff with name, email, phone, password, and role (admin, editor, or reader).
• Edit any account — change details, promote/demote roles, or set a new password (leave the password blank to keep the current one).
• Approve volunteer readers: reader applications from the public signup arrive with the pending role — promote them to reader to activate, or remove them.

32. Volunteer readers Editors

A built-in first-read program that scales your journal without scaling your masthead:

1. Enable Allow Volunteer Reader Signups (and optionally the footer link) in Settings, and set your reader-guidelines URL.
2. Writers and fans apply through the public form; applications wait in the Staff page as pending.
3. Approved readers log in to the Readers Area, where they see pending submissions they haven't yet rated and score each 1–10. Their recent ratings are shown back to them alongside how other readers scored the same pieces, which self-calibrates your pool.
4. Editors see the resulting average score column on the slush pile and can read reader notes on each piece (if enabled) — pre-sorted slush, effectively.

Privacy knobs: Blind Reader Comments hides contributor cover notes from readers; Reader Notes controls whether readers can view/leave private notes at all.

33. Settings reference Editors

Everything on the Settings page (admins), in one table:

34. Email (SMTP) setup Editors

All outgoing mail — confirmations, resets, status notifications, mail-center campaigns — flows through one SMTP account configured on the SMTP page:

Use Send Test Email at the bottom of the page after saving — it sends a real message through your settings and reports success or the exact SMTP error. Do this before opening submissions.

35. PayPal setup Editors

PayPal is optional and used only for contest entry fees. It uses PayPal's modern Checkout (Orders v2 REST) — writers can pay with a PayPal balance or a card, and the money lands in your PayPal business account.

Getting credentials

1. Sign in at developer.paypal.com → Apps & Credentials.
2. Create an app; copy the Client ID and Secret. Note there are separate Sandbox and Live credential pairs.

Configuring

Two equivalent places — the PayPal page in the Suite (stored in the database; secret write-only, never redisplayed), or the paypal_config.php file (takes precedence if filled in). Either way you set: environment (sandbox/live), Client ID, Secret, currency, and the master enabled switch.

1. Start in sandbox with sandbox credentials. Use Test Connection to verify authentication.
2. Create a test contest edition, submit to it with a sandbox buyer account, and confirm the entry appears marked PAID.
3. Swap in Live credentials, set environment to live, tick enabled, and re-test with a small real fee.

How the money flow protects you

• The order is created server-side; the writer approves it on PayPal's site; on return the app captures and verifies the payment directly with PayPal — status, amount, currency, and order identity must all match before the entry is accepted.
• Nothing a browser sends can fake a payment. Failed or mismatched captures are logged and the writer is shown a payment-failed page with nothing submitted.
• Cancelled checkouts are cleaned up automatically (the uploaded file is discarded).
• If PayPal is disabled, contests still work via submission credits — the form says PayPal is unavailable and points writers to request a credit.

36. Editing guidelines Editors

Your submission guidelines are one HTML document shown to writers before signup and before every submission. Edit them on the Guidelines page in the Suite (admins) — it edits guidelines_content.html directly, so you can also update that file over FTP with any editor if you prefer. Standard HTML plus the shipped classes (callout, callout-warn, ornament) are available; the placeholder content that ships with the product demonstrates all of them.

Appendix A — Feature summary

Appendix B — File & folder map

/                       writer-facing app (home, signup, login, submit, dashboard…)
/editors/               the Editorial Suite (staff login, slush pile, all admin)
/attachments/           uploaded files (script execution disabled by .htaccess)
/captcha/               built-in image captcha (used when Turnstile keys are blank)
/install/               web installer + schema.sql   ← DELETE AFTER INSTALLING
/docs/                  this documentation
/phpmailer/             bundled PHPMailer library (SMTP email)
/tinymce/               bundled TinyMCE editor (bios, guidelines)
config-sample.php       configuration template (installer writes config.php)
paypal_config.php       optional PayPal credentials file (blank by default)
guidelines_content.html your submission guidelines (editable in the Suite)
styles.css              the entire design system — restyle freely
LICENSE.txt             the free-use license
README.md               quick-start version of this guide

Appendix C — Configuration reference

config.php

Other knobs

Appendix D — License

Green Submissions is free for any use, personal or commercial, under one condition: the footer credit —

"Submission Manager by Glenn Lyvers, provided freely through greensubmissions.com"

— must remain visible on every page with the link active. You may restyle it to match your site; you may not remove, hide, or disable it. Removing the credit terminates the license. You may modify the software, and share the original package freely (this license travels with it).

No warranty

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

You are responsible for your own data, backups, legal compliance (including payment processing and privacy law), and server security. This documentation is provided on the same as-is basis and may not reflect every configuration of every host.

Full terms, including the licenses of bundled third-party components (PHPMailer, TinyMCE), are in LICENSE.txt in the distribution package.