check_captcha($_POST['captcha'], $_POST['captcha_hash']))) header("Location: ".$_POST['referer']."&error=captcha#addcomment");
else {
$date=time();
safe_query("INSERT INTO ".PREFIX."comments ( parentID, type, nickname, date, comment, url, email, ip )
values( '$parentID', '$type', '".mysql_escape_string($name)."', '$date', '".mysql_escape_string($message)."', '".mysql_escape_string($url)."', '".mysql_escape_string($mail)."', '$ip' ) ");
header("Location: ".$_POST['referer']);
}
}
elseif($_POST['saveusercomment']) {
include("_mysql.php");
include("_settings.php");
include("_functions.php");
if(!$userID) die('Not logged in.');
$parentID = $_POST['parentID'];
$type = $_POST['type'];
$message = $_POST['message'];
$date=time();
safe_query("INSERT INTO ".PREFIX."comments ( parentID, type, userID, date, comment ) values( '$parentID', '$type', '$userID', '$date', '".mysql_escape_string($message)."' ) ");
header("Location: ".$_POST['referer']);
}
elseif($_GET['delete']) {
include("_mysql.php");
include("_settings.php");
include("_functions.php");
if(!isanyadmin($userID)) die('No access.');
foreach($_POST['commentID'] as $id) {
safe_query("DELETE FROM ".PREFIX."comments WHERE commentID='$id'");
}
header("Location: ".$_POST['referer']);
}
elseif($_GET['editcomment']) {
$id=$_GET['id'];
$referer=$_GET['ref'];
if(isfeedbackadmin($userID) OR iscommentposter($userID,$id)) {
if(!empty($id)) {
$dt = safe_query("SELECT * FROM ".PREFIX."comments WHERE commentID='".$id."'");
if(mysql_num_rows($dt)) {
$ds = mysql_fetch_array($dt);
$poster=''.getnickname($ds[userID]).'';
$message=getinput($ds[comment]);
$message=preg_replace("#\n\[br\]\[br\]\[hr]\*\*(.+)#si", '', $message);
$message=preg_replace("#\n\[br\]\[br\]\*\*(.+)#si", '', $message);
eval("\$comment_edit = \"".gettemplate("comment_edit")."\";");
echo $comment_edit;
} else {
redirect($referer, "No database entry matching commentID - redirecting", 2);
}
} else {
redirect($referer, "No commentID specified - redirecting", 2);
}
} else {
redirect($referer, "Access denied.", 2);
}
}
elseif($_POST['saveeditcomment']) {
include("_mysql.php");
include("_settings.php");
include("_functions.php");
if(!isfeedbackadmin($userID) AND !iscommentposter($userID,$_POST[commentID])) die('No access');
$message=$_POST['message'];
$author=$_POST['authorID'];
$referer=urldecode($_POST['referer']);
// check if any admin edited the post
if(safe_query("UPDATE ".PREFIX."comments SET comment='".mysql_escape_string($message)."' WHERE commentID='".$_POST[commentID]."'")) {
header("Location: $referer");
}
}
else {
$page = $_GET['page'];
$sort = $_GET['sort'];
$sorttype = $_GET['sorttype'];
if($_GET['parentID']) $parentID = $_GET['parentID'];
if($_GET['type']) $type = $_GET['type'];
$alle=safe_query("SELECT commentID FROM ".PREFIX."comments WHERE parentID='$parentID' AND type='$type'");
$gesamt=mysql_num_rows($alle);
$pages=1;
if(!isset($page)) $page = 1;
if(!isset($sort)) $sort = "date";
if(!isset($sorttype)) $sorttype = "DESC";
$max=$maxfeedback;
for ($n=$max; $n<=$gesamt; $n+=$max) {
if($gesamt>$n) $pages++;
}
if($pages>1) $page_link = makepagelink("$referer&sorttype=$sorttype", $page, $pages);
if ($page == "1") {
$ergebnis = safe_query("SELECT * FROM ".PREFIX."comments WHERE parentID='$parentID' AND type='$type' ORDER BY date $sorttype LIMIT 0,$max");
if($sorttype=="DESC") $n=$gesamt;
else $n=1;
}
else {
$start=$page*$max-$max;
$ergebnis = safe_query("SELECT * FROM ".PREFIX."comments WHERE parentID='$parentID' AND type='$type' ORDER BY date $sorttype LIMIT $start,$max");
if($sorttype=="DESC") $n = $gesamt-($page-1)*$max;
else $n = ($page-1)*$max+1;
}
if($gesamt) {
echo'comments:
';
}
if($comments_allowed) {
if($loggedin) {
eval ("\$comments_add_user = \"".gettemplate("comments_add_user")."\";");
echo $comments_add_user;
}
elseif($comments_allowed == 2) {
$ip = getenv(REMOTE_ADDR);
if (isset($visitor_info)) {
$visitor = explode("--||--", $visitor_info);
$name = $visitor[0];
$mail = $visitor[1];
$url = $visitor[2];
}
else $url = "http://";
if($_GET['error']=="nickname") $error = 'YOU ARE NOT ALLOWED TO USE THIS NICKNAME';
elseif($_GET['error']=="captcha") $error = 'The security code is wrong!';
$CAPCLASS = new Captcha;
$captcha = $CAPCLASS->create_captcha();
$hash = $CAPCLASS->get_hash();
$CAPCLASS->clear_oldcaptcha();
eval ("\$comments_add_visitor = \"".gettemplate("comments_add_visitor")."\";");
echo $comments_add_visitor;
}
else echo'
To add your comment you have to be registered and logged in!
• register now
• log in';
}
else echo'
comments disabled.';
}
?>