Проверка на код за коментари

S

SWAG

Registered
Помъчих се да направя слдената форма за добавяне на коментари но незнам дали съм го зглобил правилно.
Малко е дълаг и от сега се извинявам за главоболията но както се казва четири очи виждат по добре от две.

А ето го и кода:
PHP: 
				<?php
$id = addslashes($_GET['id']);
if ($id) {
$zaqvka = mysql_query("SELECT * FROM `fullstory` WHERE id='$id'");
$update = mysql_query("UPDATE news SET views=views+1 WHERE id='$id'"); 

$res = mysql_fetch_assoc($zaqvka);
if($id != $res[id])
{
echo "Няма такава новина!";
}
else
{

$sql = mysql_query("SELECT * FROM fullstory WHERE id='$id'") or die (mysql_error());
$data = mysql_fetch_assoc($sql);
echo "
<div class='news mini'>
					<div class='news-title'>$data[title]</div>
					<div class='news-text'>
						<div id='news-id-50' style='display:inline;'>$data[new]<div class='shr_class shareaholic-show-on-load'></div></div>
						<div class='clear'></div>
					</div>
					<div class='news-meta'>
						<ul class='reset'>
							<li>Автор: $data[author]</li>
							<li>Дата: $data[date]</li>
							<li>Прегледана: $data[views]</li>
						</ul>
						<div class='full-link'><a href='index.php'>Назад</a></div>
					</div>
				</div>
 ";

 
if(!$user->data['is_registered']){
echo "X";
}else{

echo '<br />
<br />

<table>
<form method="POST" action="" name="inputform" id="form">';

$id = $data['id'];
$rl = mysql_query('SELECT COUNT(*) as ctn FROM `com_fullstory` WHERE news='.$id);
$ruw = mysql_fetch_assoc($rl);
$comments = $ruw['ctn'];
echo "
<tr><td></td>";
if($comments == 0){

echo "";
}

echo"<td></tr><br />";
?>
<div class='news mini'>
					<div class='news-title'>Коментари</div>
					<div class='news-text'>
						<div id='news-id-50' style='display:inline;'>
                      <div style="border: 1px solid #000000; padding: 1px;"> 
                      <div style='width:98%'>
                      <input type='image' src='bbcodes/emo.gif' class='bbcodes' onclick="return overlay(this, 'bbcode_smileys_list_message', 'bottomleft');"   title='Smileys' />
                      <div id='bbcode_smileys_list_message' class='tbl1' style='display:none;-moz-border-radius:0px;border:1px solid #c0c0c0;position:absolute;overflow:auto;width:auto;height:auto;' onclick="overlayclose('bbcode_smileys_list_message');">
                      <img src='emoticons/smile.gif' onclick="insertText('komentar', ':)', 'inputform');" />
                      <img src='emoticons/tong.gif' onclick="insertText('komentar', ':P', 'inputform');" />
                      <img src='emoticons/bigsmile.gif' onclick="insertText('komentar', ':D', 'inputform');" />
                      <img src='emoticons/kiss.gif' onclick="insertText('komentar', ':*', 'inputform');" />
                      
                      <img src='emoticons/crying.gif' onclick="insertText('komentar', ';(', 'inputform');" />
                      <img src='emoticons/wink.gif' onclick="insertText('komentar', ';)', 'inputform');" />
                      <img src='emoticons/hi.gif' onclick="insertText('komentar', '(wave)', 'inputform');" />
                      <img src='emoticons/nod.gif' onclick="insertText('komentar', '(nod)', 'inputform');" />
                      <img src='emoticons/finger.gif' onclick="insertText('komentar', '(finger)', 'inputform');" />
                      <img src='emoticons/mooning.gif' onclick="insertText('komentar', '(mooning)', 'inputform');" />
                      <img src='emoticons/wondering.gif' onclick="insertText('komentar', '(wondering)', 'inputform');" />
                      <img src='emoticons/yes.gif' onclick="insertText('komentar', '(yes)', 'inputform');" />
                      <img src='emoticons/no.gif' onclick="insertText('komentar', '(no)', 'inputform');" />
                      <img src='emoticons/party.gif' onclick="insertText('komentar', '(party)', 'inputform');" />
                      </div>
                      <input type='image' src='img/bbimg/b.png' class='bbcodes' onclick="addText('komentar','[b]','[/b]','inputform');return false;"   title='Удебелява избрания текст' />
                      <input type='image' src='img/bbimg/i.png' class='bbcodes' onclick="addText('komentar','[i]','[/i]','inputform');return false;"   title='Прави текста наклонен' />
                      <input type='image' src='img/bbimg/u.png' class='bbcodes' onclick="addText('komentar','[u]','[/u]','inputform');return false;"   title='Прави избрания текст подчертан' />
                      <input type='image' src='img/bbimg/url.png' class='bbcodes' onclick="addText('komentar','[url]','[/url]','inputform');return false;"   title='Прави URL кликване' />
                      <input type='image' src='img/bbimg/img.png' class='bbcodes' onclick="addText('komentar','[img]','[/img]','inputform');return false;"   title='Показва изображение от определена страница' />
                      <input type='image' src='img/bbimg/code.png' class='bbcodes' onclick="addText('komentar','[code]','[/code]','inputform');return false;"   title='Показва текста като код' />
                      <input type='image' src='img/bbimg/quote.png' class='bbcodes' onclick="addText('komentar','[quote]','[/quote]','inputform');return false;"   title='Цитат' />
                      <a onclick="document.getElementById('submit').value=entobg(document.getElementById('submit').value);">
                      <img style="float: right; margin-top: 7px;" src="img/bg.png" title="Смени езика на БГ" /></a>
                      </div><hr style="border: 1px solid #000000;" /><br/>
                      <textarea style="width: 100%; height: 150px; margin-top: -15px; border: none; solid #000000; " id="submit" name="komentar"></textarea>
                      <div id="err" style='margin-left: 1px; margin-top: 3px; display:none;'></div>
                      </div><input type="submit" name="submit" id="addcomment" value="Добави коментара" class="button" style="margin-top: 7px;" /><input type="reset" name="submit" class="buttona" value="Изчисти" style="margin-top: 7px;" />
					  <div class="clear"></div>
					</div>
					</div>
					</div>
<?php
echo '</form>

</table>
		
	<br /><br />';

echo '<div style="width:98%"> <b>Коментари</div></b>';}
}
}

if ($_POST['submit']) {
$user_avatar = htmlspecialchars($user->data['user_avatar']);
$avtor = htmlspecialchars($user->data['username']);
$komentar = htmlspecialchars($_POST['komentar']);
$self = $_SERVER['PHP_SELF'];
$user_group_comment = $user->data['group_id'];
$comment = $_POST['text']; 
$komentar = preg_replace('/(\r\n|\n|\r)/','<br />',$komentar);
$komentar=preg_replace("/\[b\](.+?)\[\/b\]/s", '<b>$1</b>',$komentar);
$komentar=preg_replace("/\[i\](.+?)\[\/i\]/s", '<i>$1</i>',$komentar);
$komentar=preg_replace("/\[u\](.+?)\[\/u\]/s", '<u>$1</u>',$komentar);
$komentar=preg_replace("/\[s\](.+?)\[\/s\]/s", '<s>$1</s>',$komentar);
$komentar=preg_replace("/\[m\](.+?)\[\/m\]/s", '<marquee  onmouseout="this.start()" onmouseover="this.stop()" loop="-1" scrollamount="3" width="30%">$1</marquee>',$komentar);
$komentar=preg_replace("/\[quote\](.+?)\[\/quote\]/s", '<div class="quotemain">$1</div>',$komentar);
$komentar=preg_replace("/\[quote\=(.+?)](.+?)\[\/quote\]/s", '<div class="Htable" style="width: 630px; height: 20px;"><b>$1</b> каза:</div><div style="margin-top: -5px; border-top: none; -moz-border-radius-topleft:5px; -moz-border-radius-topright:5px;" class="form">$2</div>',$komentar);
$komentar=preg_replace("/\[url\](.+?)\[\/url\]/s", '<a href="$1" target="_blank" class="url">$1</a>',$komentar);
$komentar=preg_replace("/\[url\=(.+?)\](.+?)\[\/url\]/s", '<a href="$1" target="_blank" class="url">$2</a>',$komentar);
$komentar=preg_replace("/\[img\](.+?)\[\/img\]/s", '<img src="$1" />',$komentar);
$komentar=preg_replace("/\[img\=(.+?)](.+?)\[\/img\]/s", '<a href="$1" target="_blank">$2 - Изображение</a>',$komentar);
$komentar=preg_replace("/\[color\=(.+?)\](.+?)\[\/color\]/s", '<span style="color:$1">$2</span>',$komentar);
$komentar=preg_replace("/\[size\=(.+?)\](.+?)\[\/size\]/s", '<span style="font-size:$1">$2</span>',$komentar);
$komentar=preg_replace("/\[code\](.+?)\[\/code\]/s", '<div style="-moz-border-radius: 5px;-webkit-border-radius: 5px;background: #FFF; padding: 5px; border: 1px solid #DDD; color: teal;"><code>$1</code></div>', $komentar);
$komentar = str_replace(":)",'<img src="emoticons/smile.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace(":P",'<img src="emoticons/tong.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace(":D",'<img src="emoticons/bigsmile.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace(":*",'<img src="emoticons/kiss.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace(";(",'<img src="emoticons/crying.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace(";)",'<img src="emoticons/wink.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace("(wave)",'<img src="emoticons/hi.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace("(nod)",'<img src="emoticons/nod.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace("(finger)",'<img src="emoticons/finger.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace("(mooning)",'<img src="emoticons/mooning.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace("(wondering)",'<img src="emoticons/wondering.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace("(yes)",'<img src="emoticons/yes.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace("(no)",'<img src="emoticons/no.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$komentar = str_replace("(party)",'<img src="emoticons/party.gif" style="margin-left: 2px;margin-right: 2px">',$komentar);
$date = date("d.M.Y, H:i");
	if($komentar == NULL){
		echo "<b>Всички полета са задължителни!!!</b>";
	}
	else
	{
$sql = "INSERT INTO com_fullstory (`news`, `user_avatar`, `avtor`, `date`, `komentar`, `user_group_comment`) VALUES ('$id', '$user_avatar', '$avtor', '$date', '$komentar','$user_group_comment')";
mysql_query($sql) or die (mysql_error());
echo "<meta http-equiv='refresh' content='0;url=$self?id=$data[id]'>";
echo "<b>Коментара е добавен успешно.</b>";
}
}

$sql = "SELECT * FROM com_fullstory WHERE novina='$id' ORDER BY id DESC";
$result = mysql_query($sql) or die (mysql_error());
while($com = mysql_fetch_assoc($result)) 
{
echo "<table><center><tr> ";
if ($com[user_avatar]){
echo "<b>";
}
if (($com[user_group_comment]) == 1){
echo"<font color='#AA0000'>";
}
if (($com[user_group_comment]) == 2){
echo"<font color='#00CCFF'>";
}
if (($com[user_group_comment]) == 3){
echo"<font color='#00AA00'>";
}
if (($com[user_group_comment]) == 4){
echo"<font color='#FF00FF'>";
}
if (($com[user_group_comment]) == 5){
echo"<font color='#0000FF'>";
}
if (($com[user_group_comment]) == 6){
echo"<font color='#FF6600'>";
}
if (($com[user_group_comment]) == 7){
echo"<font color='#CC00FF'>";
}
if (($com[user_group_comment]) == 8){
echo"<font color='#FF6600'>";
}
else{
echo"<div class='wmcomments'>
	<div class='binner'>
		<div class='comments'>
			<div class='dleft'>
				<div class='avatarbox'><img src=\"$phpbb_root_path/download/file.php?avatar=".$com['user_avatar']."\" alt=\"Твоят аватар\"/></b></div>
			</div>
			<div class='dright'>
				<h3 class='nickname'>$com[avtor]";
}
echo"
</font></h3>
				<span class='date'>$com[date]</span>
				<div class='maincont'>
				  $com[komentar]
				<div class='clr'></div>
				</div>
			</div>
			<div class='clr'></div>
		</div>
	</div>
</div></td></tr></center></table>"; 
}

?>
п.п Незнам дали тук вярно изкарвам извадката за аватарите:
PHP: 
$user_avatar = htmlspecialchars($user->data['user_avatar']);

Ето го и по надоло в кода:
PHP: 
$sql = "SELECT * FROM com_fullstory WHERE novina='$id' ORDER BY id DESC";
$result = mysql_query($sql) or die (mysql_error());
while($com = mysql_fetch_assoc($result)) 
{
echo "<table><center><tr> ";
if ($com[user_avatar]){
echo "<b>";
}
if (($com[user_group_comment]) == 1){
echo"<font color='#AA0000'>";
}
if (($com[user_group_comment]) == 2){
echo"<font color='#00CCFF'>";
}
if (($com[user_group_comment]) == 3){
echo"<font color='#00AA00'>";
}
if (($com[user_group_comment]) == 4){
echo"<font color='#FF00FF'>";
}
if (($com[user_group_comment]) == 5){
echo"<font color='#0000FF'>";
}
if (($com[user_group_comment]) == 6){
echo"<font color='#FF6600'>";
}
if (($com[user_group_comment]) == 7){
echo"<font color='#CC00FF'>";
}
if (($com[user_group_comment]) == 8){
echo"<font color='#FF6600'>";
}
else{
echo"<div class='wmcomments'>
	<div class='binner'>
		<div class='comments'>
			<div class='dleft'>
				<div class='avatarbox'><img src=\"$phpbb_root_path/download/file.php?avatar=".$com['user_avatar']."\" alt=\"Твоят аватар\"/></b></div>
Благодаря предварително за мъките.
 
Не мисля,че някой ще ти прегледа целия код,тъй като няма как да се тества,или поне не лесно.
Пробвай го и ако ти показва грешки които НЕ знаеш как да оправиш тогава може да ти помогнем/е някой.
Иначе един съвет още в началото на кода
Код: 
if(ctype_digit($_GET['id']) && $_GET['id'] != 0)
вместо addslashes ,защото ctype_digit ще позволи ID да е само числа и реално няма как да стане "заплаха"
 
Трябва да си влезнал или регистриран, за да отговориш тук.

Back
Горе