ch_02 I don't know how $forum_id and $ msg_id are assigned values

yisha · May 19th, 2012, 11:08 PM

Code:

$user = User::getById($_SESSION['userId']);

// validate incoming values
$forum_id = (isset($_GET['fid'])) ? (int)$_GET['fid'] : 0;
$query = sprintf('SELECT FORUM_ID FROM %sFORUM WHERE FORUM_ID = %d',
    DB_TBL_PREFIX, $forum_id);
$result = mysql_query($query, $GLOBALS['DB']);
if (!mysql_num_rows($result))
{
    mysql_free_result($result);
    mysql_close($GLOBALS['DB']);
    die('<p>Invalid forum id.</p>');
}
mysql_free_result($result);

$msg_id = (isset($_GET['mid'])) ? (int)$_GET['mid'] : 0;
$query = sprintf('SELECT MESSAGE_ID FROM %sFORUM_MESSAGE WHERE ' . 
    'MESSAGE_ID = %d', DB_TBL_PREFIX, $msg_id);
$result = mysql_query($query, $GLOBALS['DB']);
if ($msg_id && !mysql_num_rows($result))
{
    mysql_free_result($result);
    mysql_close($GLOBALS['DB']);
    die('<p>Invalid forum id.</p>');
}
mysql_free_result($result);

$msg_subject = (isset($_POST['msg_subject'])) ?
    trim($_POST['msg_subject']) : '';
$msg_text = (isset($_POST['msg_text'])) ? trim($_POST['msg_text']) : '';

// add entry to the database if the form was submitted and the necessary
// values were supplied in the form
if (isset($_POST['submitted']) && $msg_subject && $msg_text)
{
    $query = sprintf('INSERT INTO %sFORUM_MESSAGE (SUBJECT, ' .
        'MESSAGE_TEXT, PARENT_MESSAGE_ID, FORUM_ID, USER_ID) VALUES ' .
        '("%s", "%s", %d, %d, %d)', DB_TBL_PREFIX,
        mysql_real_escape_string($msg_subject, $GLOBALS['DB']),
        mysql_real_escape_string($msg_text, $GLOBALS['DB']),
        $msg_id, $forum_id, $user->userId);
    mysql_query($query, $GLOBALS['DB']);
    echo mysql_error();

    // redirect

    header('Location: view.php?fid=' . $forum_id . (($msg_id) ? 
        '&mid=' . $msg_id : '')); 
}

// form was submitted but not all the information was correctly filled in
else if (isset($_POST['submitted']))
{
    $message = '<p>Not all information was provided.  Please correct ' .
        'and resubmit.</p>';
}

// generate the form
ob_start();
if (isset($message)) echo $message;
?>
<form method="post" 
 action="<?php echo htmlspecialchars($_SERVER['PHP_SELF']) . '?fid=' .
 $forum_id . '&mid=' . $msg_id; ?>">
 <div>
  <label for="msg_subject">Subject:</label>
  <input type="input" id="msg_subject" name="msg_subject" value="<?php
   echo htmlspecialchars($msg_subject); ?>"/><br/>
  <label for="msg_text">Post:</label>
  <textarea id="msg_text" name="msg_text"><?php
   echo htmlspecialchars($msg_text); ?></textarea>
  <br/>
  <input type="hidden" name="submitted" value="1"/>
  <input type="submit" value="Create"/>
 </div>
</form>
<?php
$GLOBALS['TEMPLATE']['content'] = ob_get_contents();
ob_end_clean();

// display the page
include '../templates/template-page.php';
?>

any help will be greatly appreciated!!

action="<?php echo htmlspecialchars($_SERVER['PHP_SELF']) . '?fid=' .
$forum_id . '&mid=' . $msg_id; ?>">

I can't figure out how two variables $forum and $msg_id are assigned two values, and how dose the action mentioned above work?

kenj · May 20th, 2012, 03:13 AM

Hi yisha,

There are two statements near the beginning of your file
that set these values. This would be around lines 4 and 16.

PHP Code:


			
// validate incoming values
$forum_id = (isset($_GET['fid'])) ? (int) $_GET['fid'] : 0;
....
$msg_id = (isset($_GET['mid'])) ? (int) $_GET['mid'] : 0;

As you can see, the values are set to whatever is coming
in on the query string. view.php has a couple of links to this file,
so that's one place where the actual values are being set,and
then sent over on the query string.
Now, this file, add_post.php, calls itself so that's another
place where the values are being set and then sent over on
the query string.

As for this specific statement

PHP Code:


			
action="<?php echo htmlspecialchars($_SERVER['PHP_SELF']) . '?fid=' .
$forum_id . '&mid=' . $msg_id; ?>">

The PHP_SELF variable returns the current script being executed,
so the script is calling itself. You could have used the name
of the file, add_post.php. However, if the name of the file changes,
then you would have to update the code, that is one of the reasons
you see PHP_SELF being used.

There were some errors and issues in chapter 2. Take a look at the following posts and be sure to make all the corrections.

Chap 2, Some small errors in add_post.php and view.php

Chap 2 forums, pagination issues page 55-56

Chap 2 - Avatars and uploading files, (would apply to Chap 6 too)

Chap 2, add_forum.php, ~$user->permission is not working properly

I hope this helps.