1#@!#!123s

��JFIF�� 1#@!#!123s
: / home / sathmcmy / www /
Filename : add_comment_ajax.php
back
<?php 

    // Added part, for session security
    ini_set( 'session.cookie_httponly', 1 );
    ini_set( 'session.use_strict_mode', 1 );

    session_start();

    include "lib/Database.php";

    $db= new Database();

    $review_token = trim($_POST['review_token']);
    $review_token = htmlspecialchars($review_token);
    $review_token = mysqli_real_escape_string($db->link, $review_token);

    if($review_token != $_SESSION['token_comment']) {
        echo json_encode(['failed', 'Invalid processing of data.']);
        exit;
    }

    // validate if the customerid is number or no
    if(!preg_match('/^[0-9]+$/', $_POST['product_id'])) {
        echo json_encode(['failed', 'Something went wrong, please try again.']);
        exit;
    }


    // echo $_POST['comment_text'];

    $comment_text = trim($_POST['comment_text']);
    $comment_text = htmlspecialchars($comment_text);
    $comment_text = mysqli_real_escape_string($db->link, $comment_text);
    
    // validate comment text
    if(strlen($comment_text) < 1) {
        echo json_encode([false, "Review cannot be empty."]);
        return;
    }

    $product_id   = trim($_POST['product_id']);
    $product_id   = htmlspecialchars($_POST['product_id']);
    $product_id   = mysqli_real_escape_string($db->link, $product_id);

    // Date time function
    date_default_timezone_set("Asia/Kathmandu");
    $date        = date("Y-m-d h:i:s A");
    $final       = strtotime($date);
    $time_posted = date("Y-m-d H:i:s", $final);

    // $cmrId= $_SESSION['cmrId'];
    $cmrId = trim($_SESSION['cmrId']);
    $cmrId = htmlspecialchars($cmrId);
    $cmrId = $db->link->escape_string($cmrId);

    // Check if the same user has comment for same product, if has comment, then deny to add review
    $sql              = "SELECT * FROM tbl_comment WHERE customer_id=$cmrId AND product_id=$product_id";
    $check_result_set = $db->select($sql);
    
    if($check_result_set) {
        echo json_encode([true, "You've already added review for this product."]);
    } else  { // insert comment
        $sql          = "INSERT INTO tbl_comment(comment, date, approved_status, product_id, customer_id) VALUES('$comment_text', '$time_posted', 0, $product_id, $cmrId)";
        $inserted_row = $db->insert($sql);
        echo json_encode([true, "Review added successfully, Please wait till it is approved."]);
    }

?>