<?
//connect to
your
database
mysql_connect(
"localhost
",
"gilrok_Gi
lrok",
"BUHUFXQE&
quot;);
mysql_select_d
b("gilrok_
useraccounts&qu
ot;);
//query
comments for
this page of
this article
$inf =
"SELECT *
FROM `comments`
WHERE page =
'".stripsl
ashes($_SERVER[
'REQUEST_URI'])
."' ORDER
BY time
ASC";
$info =
mysql_query($in
f);
if(!$info)
die(mysql_error
());
$info_rows =
mysql_num_rows(
$info);
if($info_rows
> 0) {
echo
'<h5>Comm
ents:</h5>
;';
echo
'<table
width="95%
">';
while($info2 =
mysql_fetch_obj
ect($info)) {
echo
'<tr>';
echo
'<td>&quo
t;'.stripslashe
s($info2->su
bject).'"
by: <a
href="'.$i
nfo2->contac
t.'">'.
stripslashes($i
nfo2->userna
me).'</a>
</td>
<td><d
iv
align="rig
ht"> @
'.date('h:i:s
a',
$info2->time
).' on
'.$info2->da
te.'</div>
;</td>';<
br />
echo
'</tr><
;tr>';
echo '<td
colspan="2
">
'.stripslashes(
$info2->comm
ent).'
</td>';
echo
'</tr>';<
br />
}//end while
echo
'</table>
';
echo '<hr
width="95%
"
noshade>';
} else echo 'No
comments for
this page. Feel
free to be the
first
<br>';
if(isset($_POST
['submit']))
{
if(!addslashes(
$_POST['usernam
e']))
die('<u>E
RROR:</u>
you must enter
a username to
add a
comment.');
if(!addslashes(
$_POST['contact
']))
die('<u>E
RROR:</u>
enter contact
method in
contact
field.');
if(!addslashes(
$_POST['subject
']))
die('<u>E
RROR:</u>
enter a subject
to your
comment.');
if(!addslashes(
$_POST['comment
']))
die('<u>E
RROR:</u>
cannot add
comment if you
do not enter
one!?');
//this is for a
valid
contact
if(substr($_POS
T['contact'],0,
7) != 'mailto:'
&&
!strstr($_POST[
'contact'],'//'
)) {
if(strstr($_POS
T['contact'],'@
'))
$_POST['contact
'] =
"mailto:&q
uot;.$_POST['co
ntact']."&
quot;;
else
$_POST['contact
'] =
"http://&q
uot;.$_POST['co
ntact']."&
quot;;
} //end
valid
contact
//try to
prevent
multiple posts
and
flooding...
$c =
"SELECT *
from `comments`
WHERE ip =
'".$_SERVE
R['REMOTE_ADDR'
]."'"
;
$c2 =
mysql_query($c)
;
while($c3
=
mysql_fetch_obj
ect($c2)) {
$difference =
time() -
$c3->time;
if($difference
< 300)
die('<u>A
LERT:</u>
'.$c3->usern
ame.', You have
already
commented
earlier; if you
have a
question, try
the
forums!<BR&g
t;');
} //end
while
//add
comment
$q
="INSERT
INTO `comments`
(article_id,
page, date,
time, username,
ip, contact,
subject,
comment) VALUES
('".$_GET[
'id']."',
'".$_POST[
'page']."'
,
'".$_POST[
'date']."'
,
'".$_POST[
'time']."'
,
'".addslas
hes(htmlspecial
chars($_POST['u
sername'])).&qu
ot;',
'".$_SERVE
R['REMOTE_ADDR'
]."',
'".addslas
hes(htmlspecial
chars($_POST['c
ontact'])).&quo
t;',
'".addslas
hes(htmlspecial
chars($_POST['s
ubject'])).&quo
t;',
'".addslas
hes(htmlspecial
chars(nl2br($_P
OST['comment'])
))."')&quo
t;;
$q2 =
mysql_query($q)
;
if(!$q2)
die(mysql_error
());
//refresh page
so they can see
new comment
header('Locatio
n: http://' .
$_SERVER['HTTP_
HOST'] .
$_POST['page']
.
"#comments
");
} else {
//display
form
?>
<form
name="comm
ents"
action="&l
t;?
$_SERVER['PHP_S
ELF'];
?>"
method="po
st">
<input
type="hidd
en"
name="page
"
value="<
;?
echo($_SERVER['
REQUEST_URI']);
?>">
<input
type="hidd
en"
name="date
"
value="<
;?
echo(date("
;F j,
Y."));
?>">
<input
type="hidd
en"
name="time
"
value="<
;?
echo(time());
?>">
<table
width="90%
"
border="0&
quot;
cellspacing=&qu
ot;0"
cellpadding=&qu
ot;0"><
br />
<tr>
<td><d
iv
align="rig
ht">Use
rname:
</div><
;/td>
<td><i
nput
name="user
name"
type="text
"
size="30&q
uot;
value="&qu
ot;></td&
gt;
</tr>
<tr>
<td><d
iv
align="rig
ht">Con
tact:
</div><
;/td>
<td><i
nput
type="text
"
name="cont
act"
size="30&q
uot;
value="&qu
ot;>
<i>(email
or
url)</i>&
lt;/td>
</tr>
<td><d
iv
align="rig
ht">Sub
ject:
</div><
;/td>
<td><i
nput
type="text
"
name="subj
ect"
size="30&q
uot;
value="&qu
ot;></td&
gt;
</tr>
<tr>
<td><d
iv
align="rig
ht">Com
ment:
</div><
;/td>
<td><t
extarea
name="comm
ent"
cols="45&q
uot;
rows="5&qu
ot;
wrap="VIRT
UAL">&l
t;/textarea>
</td>
</tr>
<tr>
<td></
td>
<td
colspan="2
"><i
nput
type="rese
t"
value="Res
et
Fields">
;
<input
type="subm
it"
name="subm
it"
value="Add
Comment"&g
t;</td>
</tr>
</table><
br />
</form>
<?
} // end
else
?>
