use htmlspecialchars to escape authorname

[dylansserver.git] / model / note.php

diff --git a/model/note.php b/model/note.php
index 01338be..f0c54cb 100644 (file)
--- a/model/note.php
+++ b/model/note.php
@@ -12,6 +12,7 @@ class note extends model {
   public $day_posted;
   public $text;
   public $number_of_comments;
+  public $comments;
 
   public function __construct() {
     parent::__construct();
@@ -23,6 +24,11 @@ class note extends model {
       $url = substr($url, 0, (strlen($url)-6));
     }
     $this->url = $url;
+    $this->fetch_note();
+    $this->fetch_comments();
+  }
+
+  public function fetch_note() {
     $sql = "SELECT title, date_posted, text, id
               FROM notes WHERE url = ?";
     $result = $this->query($sql, "s",
@@ -40,6 +46,9 @@ class note extends model {
     } else {
       throw new notFound();
     }
+  }
+
+  public function fetch_comments() {
     $sql = "SELECT COUNT(*) FROM comments
               WHERE note = $this->id";
     $result = $this->db->query($sql);
@@ -54,6 +63,40 @@ class note extends model {
       require_once("view/note.php");
   }
 
+  public function display_comment_link() {
+    if ($this->number_of_comments > 0) {
+      $anchor_text = "comments($this->number_of_comments)/";
+    } else {
+      $anchor_text = "comment?";
+    }
+    if (substr($this->url, (strlen($this->url)-1), strlen($this->url)) == '/') {
+      $url = $this->url . 'comments/';
+    } else {
+      $url = $this->url . '/comments/';
+    }
+    echo "<a id='comment_link' href='$url'>$anchor_text</a>";
+  }
+
+  public function display_comments() {
+    $sql= "SELECT date_posted, author, text
+             FROM comments WHERE note = ?
+             ORDER BY date_posted DESC";
+    $result = $this->query($sql, 'd', $this->id);
+    $i = 0;
+    foreach ($result as $row => $entry) {
+      $this->comment[$i]['date_posted'] = $entry['date_posted'];
+      $this->comment[$i]['author']  = htmlspecialchars($entry['author']);
+      $this->comment[$i]['text'] = htmlspecialchars($entry['text']);
+      $i++;
+    }
+    require_once('view/comment.php');
+  }
+
+  public function display_comment_form() {
+    $publickey = $this->recaptcha_publickey;
+    require_once("view/comment-form.php");
+  }
+
   public function verify() {
     if (!isset($_POST['captcha'])) {
       require_once('includes/recaptchalib.php');
@@ -82,43 +125,6 @@ class note extends model {
     }
   }
 
-  public function display_comment_link() {
-    if ($this->number_of_comments > 0) {
-      $anchor_text = "comments($this->number_of_comments)/";
-    } else {
-      $anchor_text = "comment?";
-    }
-    if (substr($this->url, (strlen($this->url)-1), strlen($this->url)) == '/') {
-      $url = $this->url . 'comments/';
-    } else {
-      $url = $this->url . '/comments/';
-    }
-    echo "<a id='comment_link' href='$url'>$anchor_text</a>";
-  }
-
-  public function display_comments() {
-    echo "<div id='comments'>";
-    $sql= "SELECT date_posted, author, text
-             FROM comments WHERE note = ?
-             ORDER BY date_posted DESC";
-    $result = $this->query($sql, 'd', $this->id);
-    foreach ($result as $row => $entry) {
-      $date_posted = $entry['date_posted'];
-      $author = $entry['author'];
-      $text = htmlspecialchars($entry['text']);
-      $head = "<h3>" . htmlspecialchars($author) . "</h3>";
-      echo "<div class='comment'>";
-      echo $head;
-      echo $text;
-      echo "</div>";
-      }
-    echo "</div>";
-  }
-
-  public function display_comment_form() {
-    $publickey = $this->recaptcha_publickey;
-    require_once("view/comment-form.php");
-  }
 }
 
 ?>