Код:
<?php
$queryString = strtolower($_SERVER['QUERY_STRING']);
if (strstr($queryString,"<") OR strstr($queryString,">") OR strstr($queryString,"(") OR strstr($queryString,")") OR
strstr($queryString,"..") OR
strstr($queryString,"%") OR
strstr($queryString,"*") OR
strstr($queryString,"+") OR
strstr($queryString,"!") OR
strstr($queryString,"@")) {
$loc = $_SERVER['PHP_SELF'];
$ip = $_SERVER['REMOTE_ADDR'];
$date = date ("d-m-Y @ h:i:s");
$lfh = "../log.txt";
$log = fopen ( $lfh,"a+" );
fputs ($log, "Attack Date: $date | Attacker IP: $ip | QueryString: $loc?=$queryString\n");
fclose($log);
echo "You are wasting your time..."; exit;
}
require '../functions.php';
db_init();
ban_system();
$user = $_SESSION['user_info']['username'];
$post_id = (int)$_GET['post'];
if(!isset($post_id) || !is_numeric($post_id) || $post_id < 1)
{
header('Location: index.php');
exit();
}
$q = "UPDATE `posts` SET `views` = views+1 WHERE `post_id`= $post_id LIMIT 1 ";
mysql_query($q) or die(mysql_error());
$result = mysql_query("SELECT post_id, title, category, content, author, date, views FROM `posts` WHERE post_id = '$post_id'") or die (mysql_error());
$post = mysql_fetch_assoc($result);
$sql = "SELECT * FROM posts_categories WHERE cat_id='$post[category]'";
$res = mysql_query($sql) or die (mysql_error());
$cat = mysql_fetch_assoc($res);
if(isset($_POST['addComment']))
{
$post_id = $_POST['post'];
$author = $_SESSION['user_info']['username'];
$date_added = date("d.M.Y");
$comment = $_POST['comment'];
$comment = str_replace(':)', '<img src="../img/smiles/smile.png" alt="pic" />', $comment);
$comment = str_replace('(O_o)', '<img src="../img/smiles/lol.png" alt="pic" />', $comment);
$comment = str_replace(';(', '<img src="../img/smiles/cry.png" alt="pic" />', $comment);
$comment = str_replace('(chuckle)', '<img src="../img/smiles/chuckle.png" alt="pic" />', $comment);
$comment = str_replace(':*', '<img src="../img/smiles/cunka.png" alt="pic" />', $comment);
$comment = str_replace('(mmm)', '<img src="../img/smiles/mmm.png" alt="pic" />', $comment);
$comment = str_replace('(ligi)', '<img src="../img/smiles/ligi.png" alt="pic" />', $comment);
$comment = str_replace('(inlove)', '<img src="../img/smiles/inlove.png" alt="pic" />', $comment);
$comment = str_replace(':D', '<img src="../img/smiles/xaxa.png" alt="pic" />', $comment);
$comment = str_replace('|-(', '<img src="../img/smiles/pff.png" alt="pic" />', $comment);
$comment = str_replace('(OMG!)', '<img src="../img/smiles/omg.png" alt="pic" />', $comment);
$comment = str_replace('(uuu..)', '<img src="../img/smiles/uuu.png" alt="pic" />', $comment);
$comment = addslashes(htmlspecialchars($comment));
if(strlen($comment) < 2)
{
$error_com = '<center><i>Не можете да пускате коментар по - малък от 2 символa!!</i></center>';
}
else
{
mysql_query("INSERT INTO posts_comments (post_id,comment,author,date_added) VALUES ('$post_id','$comment','$author','$date_added')") or die (mysql_error());
}
$q = mysql_query("SELECT user_id FROM users WHERE username = '$post[author]'") or die (mysql_error());
$a_id = mysql_fetch_assoc($q);
}
bg_header($post['title'].' •');
?>
<div class="news_box_top"><?php echo $post['title']; ?></div>
<div class="news_box_body"><?php echo htmlspecialchars_decode($post['content']); ?></div>
<div class="right">
<div class="desc_news">
<span>Сподели</span>
<div class="right"><iframe src="http://www.facebook.com/plugins/like.php?href=http://www.tokiohotel-bg.info/bg/read_more.php?post=<?php echo $post['post_id']; ?>&layout=button_count&show_faces=false&width=125&action=like&font=verdana&colorscheme=dark&height=21" style="border: medium none; overflow: hidden; width: 125px; height: 21px; margin-left: 17px; vertical-align: center;" allowtransparency="true" scrolling="no" frameborder="0"></iframe></div>
<div class="right"><a href="http://twitter.com/share" style="width: 505px;" class="twitter-share-button" data-count="horizontal">Tweet</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script></div>
<div class="right"><g:plusone size="medium" href="http://www.tokiohotel-bg.info/bg/read_more.php?post=<?php echo $post['post_id']; ?>"></g:plusone></div>
<div style="clear: right;"></div>
<center>Тази новина е добавена на <i><?php echo $post['date']; ?></i><br />от <i><?php echo $post['author']; ?></i> в <i><a href="category.php?cat=<?php echo $cat['cat_id']; ?>"><?php echo $cat['name']; ?></a></i> и е прегледана <i><?php print $post['views']; ?></i> <sup>пъти</sup></center>
</div>
<?php
$other_title = $post['title'];
$i='';
$mysql = mysql_query("
SELECT * ,
MATCH (title)
AGAINST ('$other_title') AS score
FROM `posts`
WHERE post_id != '$post_id'
AND MATCH (title)
AGAINST ('$other_title' IN BOOLEAN MODE)
ORDER BY score DESC
LIMIT 0 , 10
") or die (mysql_error());
if (mysql_num_rows($mysql) > 0) {
while ($other = mysql_fetch_array($mysql)) {
$i++;
echo "$i: <a href=\"#\">{$other['title']}</a><br />";
}
} else {
echo " Няма намерени подобни обяви ";
}
?>
</div>
<div class="left">
<?php if($_SESSION['is_logged']===true) { ?>
<center><div id="comment_field">
<form method="post" action="">
<a href="javascript: void(0);"><img src="../img/smiles/smile.png" alt="Smile" onclick="emo(':)')" /></a>
<a href="javascript: void(0);"><img src="../img/smiles/lol.png" alt="O_o" onclick="emo('(O_o)')" /></a>
<a href="javascript: void(0);"><img src="../img/smiles/cry.png" alt="Cry" onclick="emo(';(')" /></a>
<a href="javascript: void(0);"><img src="../img/smiles/chuckle.png" alt="Chuckle" onclick="emo('(chuckle)')" /></a>
<a href="javascript: void(0);"><img src="../img/smiles/cunka.png" alt="Kiss" onclick="emo(':*')" /></a>
<a href="javascript: void(0);"><img src="../img/smiles/mmm.png" alt="Mmm..." onclick="emo('(mmm)')" /></a>
<a href="javascript: void(0);"><img src="../img/smiles/ligi.png" alt="Лиги" onclick="emo('(ligi)')" /></a>
<a href="javascript: void(0);"><img src="../img/smiles/inlove.png" alt="Влюбен" onclick="emo('(inlove)')" /></a>
<a href="javascript: void(0);"><img src="../img/smiles/xaxa.png" alt="Laugth" onclick="emo(':D')" /></a>
<a href="javascript: void(0);"><img src="../img/smiles/pff.png" alt="Stupid" onclick="emo('|-(')" /></a>
<a href="javascript: void(0);"><img src="../img/smiles/omg.png" alt="OMG!!" onclick="emo('(OMG)')" /></a>
<a href="javascript: void(0);"><img src="../img/smiles/uuu.png" alt="УуУуУ :)" onclick="emo('(wow)')" /></a><br />
<textarea id="emo" class="textarea" name="comment" rows="4" cols="50"></textarea><br />
<input type="hidden" name="post" value="<?php echo $_GET['post']; ?>" />
<input type="submit" name="addComment" class="button_reg" value=" ДОБАВИ КОМЕНТАРА " />
</form>
</div></center>
<?php }
$q = mysql_query("SELECT comment, author, date_added FROM posts_comments WHERE post_id='$post_id' ORDER BY comment_id DESC");
while($comment = mysql_fetch_assoc($q))
{
$rs = mysql_query("SELECT user_id,rank,avatar FROM users WHERE username = '".$comment['author']."'") or die (mysql_error());
$com_info = mysql_fetch_assoc($rs);
?>
<div class="comm">
<div class="name_hour">
<div class="left"><b><a href="userID.php?id=<?php echo $com_info['user_id']; ?>"><?php
if($com_info['rank'] == 0){
echo $comment['author'];
}
if($com_info['rank'] == 1){
echo '<span style="color: #fd4239; text-shadow: #000 0px 0px 2px;">'.$comment['author'].'</span>';
}
if($com_info['rank'] == 2){
echo '<span style="color: #fff100; text-shadow: #000 0px 0px 2px;">'.$comment['author'].'</span>';
}
if($com_info['rank'] == 3){
echo '<span style="color: #8fd400; text-shadow: #000 0px 0px 2px;">'.$comment['author'].'</span>';
}
if($com_info['rank'] == 5){
echo '<span style="color: #FF9900; text-shadow: #000 0px 0px 2px;">'.$comment['author'].'</span>';
}
?></a></b> каза:</div>
<div class="right"><?php
if(strlen($comment['date_added'] > 1))
{
echo '<b>Добавен на:</b> '.$comment['date_added'];
}
?></div>
<div style="clear: both;"></div>
</div>
<div class="left"><a href="userID.php?id=<?php echo $com_info['user_id']; ?>"><?php
if(strlen($com_info['avatar']) == 0)
{
echo '<img src="http://tokiohotel-bg.info/img/default.png" style="margin: 6px 3px 3px 3px; border: 1px solid #000;" width="70px" height="70px" alt="avatar" />';
}
else
{
echo '<img src="'.$com_info['avatar'].'" style="margin: 6px 3px 3px 3px; border: 1px solid #000;" width="70px" height="70px" alt="user_avatar" />';
}
?></a></div>
<p style="padding: 3px;"><?php echo htmlspecialchars_decode($comment['comment']); ?></p>
<div style="clear: left;"></div>
</div>
<?php } ?>
</div>
<div style="clear: both;"></div>
<?php
bg_footer();
?>