ucast.upm.edu.my ~ Shell I

Editing file /var/www/i3tube_old_2/comments.php (0644)

<?php

///////////////////////////////////////////////////////////////////////////////////////
// PHPmotion                                                http://www.phpmotion.com //
///////////////////////////////////////////////////////////////////////////////////////
// License: You are not to sell or distribute this software without permission       //
// Main Author: Brian Shawa -  bshawa@gmail.com                                      //
// Help and support please visit http://www.phpmotion.com                            //
// Copyright reserved                                                                //
///////////////////////////////////////////////////////////////////////////////////////

include_once("classes/config.php");

include_once('classes/menu.php') ;
include_once ('classes/sessions.php');

$vid = $_POST['vid'];
$comments = $_POST['comments'];
$todays_date = $config["date_format"];

//check if being loaded from play.php

if ($vid ==""){
die();
}

//check if comments have been filled in

if ($comments ==""){
echo ''.$config['video_comments_error_comment'].'';
die();
}

//check if user is logged in
if ($user_id == ""){
echo ''.$config['video_comments_login'].'';
die();
}

//check if users are allowed multiple posts
//if not, check if user has laready posted

$multiple_comments = $config["allow_multiple_video_comments"];
if($multiple_comments =="no"){
$user_id = mysql_real_escape_string($user_id);
$vid = mysql_real_escape_string($vid);
$sql= "SELECT * from videocomments WHERE video_id = $vid AND by_id = $user_id";
$query = mysql_query($sql);
$result = mysql_num_rows($query);

if ($result != 0){
echo ''.$config['video_comments_error_already'].'';
die();
}
}

//check if user allows video comments to their video
$sql1 = "SELECT * FROM videos WHERE indexer = $vid AND allow_comments = 'no'";
$result1 = @mysql_query($sql1);
if(@mysql_num_rows($result1) != 0){
echo ''.$config['video_comments_not_allowed'].'';
die();	
	}

$user_id = mysql_real_escape_string($user_id);
$user_name = mysql_real_escape_string($user_name);
$vid = mysql_real_escape_string($vid);
$comments = mysql_real_escape_string($comments);
$todays_date = mysql_real_escape_string($todays_date);
$sql = "INSERT into videocomments (by_id, by_username, video_id, comments, todays_date) VALUES
                                  ($user_id, '$user_name', $vid, '$comments', '$todays_date')";

mysql_query($sql);
echo ''.$config['video_comments_success'].'';
die();