"; echo <<

my projects:

@@ -287,47 +300,215 @@ class page extends cms { class note extends cms { - public function __construct() { + private $id; + private $comments_enabled = false; + private $failed_captcha; + public $url; + public $title; + public $year_posted; + public $month_posted; + public $day_posted; + public $text; + public $number_of_comments; + + public function __construct($comments_enabled = false) { parent::__construct(); - $this->check_exists(); - } - - private function check_exists() { - $sql = "SELECT COUNT(*) FROM notes - WHERE url = ?"; - $results = $this->query($sql, "s", $_GET['note']); - if ($results[0]["COUNT(*)"] != 1) { + $this->comments_enabled = $comments_enabled; + $url = htmlspecialchars($_SERVER['REQUEST_URI']); + if (isset($_GET['verify'])) { + $url = substr($url, 0, (strlen($url)-6)); + } + $this->url = $url; + $sql = "SELECT title, date_posted, text, id + FROM notes WHERE url = ?"; + $result = $this->query($sql, "s", + $_GET['note']); + if ($result) { + $entry = $result[0]; + $this->id = $entry["id"]; + $this->title = $entry["title"]; + $date_posted = explode("-", $entry["date_posted"]); + $this->year_posted = $date_posted[0]; + $this->month_posted = $date_posted[1]; + $datetime_posted = explode(' ', $date_posted[2]); + $this->day_posted = $datetime_posted[0]; + $this->text = $entry["text"]; + } else { throw new notFound(); } + $sql = "SELECT COUNT(*) FROM comments + WHERE note = $this->id"; + $result = $this->db->query($sql); + $result = $result->fetch_array(); + $this->number_of_comments = $result[0]; + if (isset($_GET['verify'])) { + $this->verify(); + } } public function display() { $this->display_head(); - $sql = "SELECT title, date_posted, text - FROM notes WHERE url = ?"; - $result = $this->query($sql, "s", - $_GET['note']); - $entry = $result[0]; - $title = $entry["title"]; - $date_posted = explode("-", $entry["date_posted"]); - $year_posted = $date_posted[0]; - $month_posted = $date_posted[1]; - $datetime_posted = explode(' ', $date_posted[2]); - $day_posted = $datetime_posted[0]; - echo "

"; - echo "

$year_posted/$month_posted/$day_posted/$title

"; - echo $entry['text']; + $this->display_note(); + if ($this->comments_enabled) { + $this->display_comments(); + $this->display_comment_form(); + } $this->write_navigation(); $this->display_close(); } + private function verify() { + if (!isset($_POST['captcha'])) { + require_once('includes/recaptchalib.php'); + echo "
"; + $resp = recaptcha_check_answer ($this->recaptcha_privatekey, + $_SERVER["REMOTE_ADDR"], + $_POST["recaptcha_challenge_field"], + $_POST["recaptcha_response_field"]); + if (!$resp->is_valid) { + $this->failed_captcha = true; + } + } + if (isset($_POST['captcha']) || $resp->is_valid) { + $sql = ("INSERT INTO comments (date_posted, author, + email, text, note) + VALUES(NOW(), ?, ?, ?, ?)"); + $stmt = $this->db->prepare($sql); + // Checks are needed here (no blank text, + // and a default author / email need to be set + // for no-javascript users. + $stmt->bind_param('ssss', + htmlspecialchars($_POST['name']), + htmlspecialchars($_POST['email']), + htmlspecialchars($_POST['text']), + $this->id); + $stmt->execute(); + } + } + + private function display_note() { + echo << +

$this->year_posted/$this->month_posted/$this->day_posted/$this->title

+ $this->text +

+END_OF_NOTE; + } + private function write_navigation() { - echo "
"; - echo ""; + echo << + +END_OF_NAVIGATION; + } + + private function display_comment_link() { + if ($this->number_of_comments > 0) { + $anchor_text = "comments($this->number_of_comments)/"; + } else { + $anchor_text = "comment?"; + } + if (substr($this->url, (strlen($this->url)-1), strlen($this->url)) == '/') { + $url = $this->url . 'comments/'; + } else { + $url = $this->url . '/comments/'; + } + echo "$anchor_text"; + } + + private function display_comments() { + echo "

"; + $sql= "SELECT date_posted, author, email, text + FROM comments WHERE note = ? + ORDER BY date_posted DESC"; + $result = $this->query($sql, "d", $this->id); + foreach ($result as $row => $entry) { + $date_posted = $entry['date_posted']; + $author = $entry['author']; + $email = $entry['email']; + $text = htmlspecialchars($entry['text']); + if ($email == '') { + $head = "

$author

"; + } else { + $head = "

$author

"; + } + echo << + $head + $text +

+END_OF_COMMENT; + } + echo "

things i've done for others:

my projects:

$year_posted/$month_posted/$day_posted/$title

$this->year_posted/$this->month_posted/$this->day_posted/$this->title

"; - echo "notes/"; - echo "

+END_OF_NAVIGATION; + if (!$this->comments_enabled) { + $this->display_comment_link(); + } + echo <<back to notes/ +

$author

$author

comment:

name:

email:

what's this say?

enter the numbers you hear: