PHP - Basic Commenting System

Hi,
I'm trying to code a very basic commenting system, my only worries is how I'm going on about disabling the user from putting any html php etc.. in the comment so it gets displayed on the page.. I have on idea of what to look for, any help is much appreciated

I considdered this: strip_tags() but what i want is to display the comment just without actually executing the code if you get me?

Hello,
       Basically i am following this tutorial -: http://tutorialzine.com/2010/06/simple-ajax-commenting-system/ for a website I am creating. But in that tutorial when you write a comment you add a name, I was wondering is it possible instead for my website to use the users username as I have a login system that I created from folowing a tutorial on the same site. I am new to PHP and web creation so please keep the comments simple.

Hi im pretty new to php but I was following a tutorial for a commenting system and implemented it onto my blog page. Anyway the problem I have is that as you go down the page each blog post displays its own comments  + the comments for the posts above it. I have checked the database and the data seems to link the correct comments to the correct posts so I am confused to why this is happening. I have looked over my code and cant seem to find a problem (probably because I suck!).

Here is the code for the blog page...

Code: [Select]
<?php
include_once ("scripts/checkuserlog.php");
include_once ("scripts/connectToMysql.php");
include_once ("functions/agoTime.php");

$myObject = new convertToAgo;
$username = '';
$errorMsg = '';
$successMsg = '';
$date = date("m.d.y");

if (isset($_GET['id'])) {
 $id = preg_replace('#[^0-9]#i', '', $_GET['id']);
} else if (isset($_SESSION['idx'])) {
 $id = $logOptions_id;
} else {
   header("location: index.php");
   exit();
}

$id = preg_replace('#[^0-9]#i', '', $id);
$sql = mysql_query("SELECT * FROM members WHERE id='$id' LIMIT 1");

$existCount = mysql_num_rows($sql); 
 if ($existCount == 0) {
 header("location: index.php?msg=user_does_not_exist");
     exit();
}

while($row = mysql_fetch_array($sql)){
$username = $row["username"];
}

if(isset($_POST['workoutName'])){
$workoutName = $_POST['workoutName'];
$workoutDescription = $_POST['workoutDescription'];

if ((!$workoutName) || (!$workoutDescription)) { 

$errorMsg = 'Please fill in both fields';
} else {

$insertBlog = mysql_query("INSERT INTO blog (userid, workoutName, workoutDescription, datetime) VALUES ('$id', '$workoutName', '$workoutDescription', now())") or die(mysql_error());

if ($insertBlog){
        $successMsg = '<span class="errorMsg">Workout blogged successfully</span>';
    } else {
$errorMsg = '<span class="errorMsg">Problems arose during the information exchange, please try again later.</span>';
    }
}
}

$getBlog = mysql_query("SELECT * FROM blog WHERE userid='$id' ORDER BY id DESC");
$blogEntries = mysql_num_rows($getBlog);

if($blogEntries < 1){
$blogDisplay = '<span class="blogName">' .$username. ' has not blogged a workout yet</span>';
} else {
while($row = mysql_fetch_array($getBlog)){

$blogEntryId = $row["id"];

$sql_comment = mysql_query("SELECT * FROM blog_comments WHERE post_id='$blogEntryId' ORDER BY id ASC");

$countComment = mysql_num_rows($sql_comment);
if($countComment > 0){
while($row2 = mysql_fetch_array($sql_comment)){
$comment_user_id = $row2["comment_user_id"];

$sql_comment_username = mysql_query("SELECT username FROM members WHERE id='$comment_user_id' LIMIT 1");

while($row3 = mysql_fetch_array($sql_comment_username)){
$comment_username = $row3["username"];}

$post_id = $row2["post_id"];
$commentBody = $row2["comment_body"];
$commentDate = $row2["comment_date"];

$displayCommentList .= '<div>' .$comment_username. ' - ' .$commentBody. ' - ' .$commentDate. '</div>';
}

} else {
$displayCommentList = '';
}
$workoutName = $row["workoutName"];
$workoutDescription = $row["workoutDescription"];
$blogDate = $row["datetime"];
$convertedTime = ($myObject -> convert_datetime($blogDate));
$blogDate = ($myObject -> makeAgo($convertedTime));

$blogDisplay .= '<table width="950px"><tr bgcolor="#DBE4FD"><td><span class="blogName">' .$workoutName. '</span>&nbsp;&raquo;&nbsp;<span class="blogDate">' .$blogDate. '</span></td></tr>
<tr bgcolor="#F1F4FE"><td><span class="blackText">' .$workoutDescription. '</span></td></tr>
<tr bgcolor="#DBE4FD" valign="top"><td>' .$displayCommentList. '</td></tr>

<div id="new_comment' .$blogEntryId. '" style="display:none"></div>

<tr><td><textarea id="comment' .$blogEntryId. '"></textarea><input type="submit" value="Comment" onclick="javascript:SendComment(\''.$blogEntryId.'\');" /></td></tr>';

if(isset($_SESSION['id'])&&$_SESSION['id']==$id){
$blogDisplay .= '<tr bgcolor="#DBE4FD"><td><a href="editBlogPost.php?id=' .$blogEntryId. '"><span class="blackText">Edit Post</span></a>&nbsp;&#38;#8211;&nbsp;<span class="blackText">Delete Post</span></td></tr></table><br /><br />';
}
}
}

if(isset($_POST['deleteButton'])){
$deleteBlog = mysql_query("DELETE FROM blog WHERE id='$blogEntryId'");

if($deleteBlog){
$successMsg = 'Blog entry deleted successfully';
} else {
$errorMsg = 'Could not process your request, please try again later';
}
}

?>
<?php
if (isset($_SESSION['id'])&&$_SESSION['id']==$id) {
$blogForm = '<table bgcolor="#DBE4FD" width="950px">
    <form action="member_blog.php" method="post" enctype="multipart/form-data">
    <tr>
    <td width="200px"><span class="blackText">Workout Name:</span></td><td width="650px"><input name="workoutName" type="text" id="workoutName" />&nbsp;&nbsp;&nbsp;&nbsp;<span class="blackText">Date: ' .$date. '</span></td></tr>
    <tr>
    <td><span class="blackText">Workout Description:</span></td><td><textarea name="workoutDescription" cols="75" rows="10" id="workoutDescription" /></textarea></td></tr>
    <tr><td><input name="submitBlog" id="submit" type="submit" value="Blog!" /></td><td><span class="errorMsg">' .$errorMsg. '' .$successMsg. '</span></td>
    </tr>
    </form>
    </table>';
} else {
$blogForm = '';
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title><?php echo ("$username"); ?>'s Blog</title>
<link href="style/layout.css" rel="stylesheet" type="text/css" />
<link href="style/main.css" rel="stylesheet" type="text/css" />
<script src="js/jquery-1.4.2.js" type="text/javascript"></script>
<script language="javascript" type="text/javascript">
function SendComment(blogEntryId){
var comment_txt = $("#comment"+blogEntryId).val();

if(comment_txt == ""){
alert("Please enter a comment");
} else {
$.post("scripts/blogComment.php", {comment: comment_txt, blogId: blogEntryId} ,function(data){
$("#new_comment"+blogEntryId).html(data);
$("#new_comment"+blogEntryId).slideDown(300);
});
}
}
</script>
</head>

<body>
<div id="container">
<?php include_once ("bannerFiles/bannerTemplate.php"); ?>
    <?php include_once ("bannerFiles/bannerMenu.php"); ?><br />
    <div id="content">
    <span class="profileUsername"><?php echo ("$username"); ?>'s Workout Blog</span><br /><br />
    <?php echo ("$blogDisplay"); ?><br /><br />
<?php echo ("$blogForm"); ?>
    </div><br /><br />
    <?php include_once ("footerFiles/footerTemplate.php"); ?>
</div>
</body>
</html>

...and here is the code for the blogComment.php page

Code: [Select]
<?php
session_start();
include_once ("connectToMysql.php");

if(isset($_POST['comment'])){
$comment = $_POST['comment'];
$blogId = $_POST['blogId'];
$comment_user_id = $_SESSION['id'];
$username = $_SESSION['username'];

$sql = mysql_query("INSERT INTO blog_comments (comment_body, post_id, comment_user_id, comment_date) VALUES ('$comment', '$blogId', '$comment_user_id', now())");

echo '<div>' .$username. ' - ' .$comment. ' - Just Now</div>';

} else {

echo "Failure";

}
?>

Thanks in advance for any help

I need some help with my commenting system. at the moment the code is like this:

<div id="pagepannel">
                <div id="ptop_small">Comments</div>
                <div id="pbottom_small">
          <p>
            <?php 
//
if ($allow_comments == "no") {
?>
          </p>
          <p>No Posting comments here!!!</p>
          <p>&nbsp;</p>
          <p>&nbsp;</p>
          <p>
            <?php } else ?>
          </p>
          <p>
            <?php 
  $sql = "SELECT comment_id, blog_id, posted_by, comment, stamp, email, type FROM jscrgaming_newscomments WHERE blog_id='$blog_id'  ORDER BY comment_id DESC";
$result = mysql_query($sql) or die('Error : ' . mysql_error()); 
      while(list($comment_id, $blog_id_co, $username, $comment, $stamp, $email, $type) = mysql_fetch_array($result, MYSQL_NUM))
{ 
if ($type == 'user'){
?>
          </p>
          <table width="95%" border="0" cellpadding="0" cellspacing="0" class="full_border">
            <tr>
              <td width="75" id="avatar"></td>
              <td><span class="capitalize"><a href="userinfo.php?user=<? echo $username ?>"><strong><? echo $username ?></strong></a></span><strong> posted</strong>: <? echo stripslashes($comment) ?></td>
            </tr>
            <tr>
              <td colspan="2" bgcolor="#CAE4FF" class="date"><? echo $stamp ?>&nbsp;</td>
            </tr>
          </table>
          <p>&nbsp;</p>
          <p>
            <? } 
else{
?>
          </p>
          <table width="95%" border="0" cellpadding="0" cellspacing="0" class="full_border">
            <tr>
              <td><strong> <? echo $username ?>posted</strong>: <? echo stripslashes($comment) ?></td>
            </tr>
            <tr>
              <td bgcolor="#CAE4FF" class="smalltext"><? echo $stamp ?>:: User Was Guest</td>
            </tr>
          </table>
          <p>&nbsp;</p>
          <p>
            <? } }?>
          </p>
          <p>
            <?php 
//
if ($allow_comments == "restricted") {

/**
 * User has already logged in, so display relavent links, including
 * a link to the admin center if the user is an administrator.
 */
if($session->logged_in){?>
          </p>
          <form id="form3" name="form3" method="post" action="user/admin/blog/comment_system/user.php">
            <p>&nbsp;</p>
            <table width="95%" border="0" align="center" cellspacing="2" class="full_border">
              <tr>
                <td colspan="2">You are commenting as <?php echo $session->username;?></td>
              </tr>
              <tr>
                <td width="75">Message</td>
                <td><textarea name="co_comment" cols="30" id="textfield10"></textarea></td>
              </tr>
              <tr>
                <td width="75"><span class="header">
                  <input name="co_username" type="hidden" id="co_username" value="<?php echo $session->username;?>" />
                  <input name="co_blog_id" type="hidden" id="co_blog_id" value="<?php echo $blog_id ?>" />
                </span></td>
                <td><label>
                  <input type="submit" class="blog_button" value=" Post " />
                </label></td>
              </tr>
              <tr>
                <td>&nbsp;</td>
                <td class="smalltext">only 200 charaters can be used</td>
              </tr>
            </table>
          </form>
          <p>&nbsp; </p>
          <p>
            <? } else {?>
          </p>
          <p>&nbsp;</p>
          <table width="95%" border="0" align="center" cellspacing="2" class="full_border">
            <tr>
              <td width="75"><span class="capitalize">Name</span></td>
              <td><label>
                <input name="textfield5" type="text" disabled="disabled" id="textfield5" size="35" />
              </label></td>
            </tr>
            <tr>
              <td width="75">Email</td>
              <td><input name="textfield5" type="text" disabled="disabled" id="textfield6" size="35" /></td>
            </tr>
            <tr>
              <td width="75">Message</td>
              <td><textarea name="textfield5" cols="30" disabled="disabled" id="textfield7">You need to be logged in to comment.</textarea></td>
            </tr>
            <tr>
              <td width="75">&nbsp;</td>
              <td><label>
                <input type="button" class="blog_button" value=" Post " />
              </label></td>
            </tr>
          </table>
          <p>&nbsp;</p>
          <p>
            <?php } } else { 
  if($session->logged_in){?>
          </p>
          <form id="form2" name="form2" method="post" action="user/admin/blog/comment_system/user.php">
            <p>&nbsp;</p>
            <table width="95%" border="0" align="center" cellspacing="2" class="full_border">
              <tr>
                <td colspan="2">You are commenting as <?php echo $session->username;?></td>
              </tr>
              <tr>
                <td width="75">Message</td>
                <td><textarea name="co_comment" cols="30" id="textfield8"></textarea></td>
              </tr>
              <tr>
                <td width="75"><input name="co_username" type="hidden" id="co_username" value="<?php echo $session->username;?>" />
                  <input name="co_blog_id" type="hidden" id="co_blog_id" value="<?php echo $blog_id ?>" /></td>
                <td><label>
                  <input type="submit" class="blog_button" value=" Post " />
                </label></td>
              </tr>
              <tr>
                <td>&nbsp;</td>
                <td><span class="smalltext">only 200 charaters can be used</span></td>
              </tr>
            </table>
          </form>
          <p>&nbsp; </p>
          <p>
            <? } else { ?>
          </p>
          <form id="form1" name="form1" method="post" action="user/admin/blog/comment_system/guest.php">
            <p>&nbsp; </p>
            <table width="95%" border="0" align="center" cellspacing="2" class="full_border">
              <tr>
                <td width="75"><span class="capitalize">Name</span></td>
                <td><label>
                  <input name="co_username" type="text" id="co_username" size="35" />
                </label></td>
              </tr>
              <tr>
                <td width="75">Email</td>
                <td><input name="guest_email" type="text" id="guest_email" size="35" /></td>
              </tr>
              <tr>
                <td width="75">Message</td>
                <td><textarea name="co_comment" cols="30" id="co_comment"></textarea></td>
              </tr>
              <tr>
                <td width="75">Spam</td>
                <td>&nbsp;</td>
              </tr>
              <tr>
                <td colspan="2" align="center"><? require_once('user/captcha/recaptchalib.php');
$publickey = "6Ld_W7sSAAAAAPNTLWrUJLEClFpSSPu1d1Ry5zNR"; // you got this from the signup page
echo recaptcha_get_html($publickey); ?></td>
              </tr>
              <tr>
                <td colspan="2" align="right"><span class="smalltext">only 200 charaters can be used</span>
                  <input name="co_blog_id" type="hidden" id="co_blog_id" value="<?php echo $blog_id ?>" />
                  <input type="submit" class="blog_button" value=" Post " /></td>
              </tr>
            </table>
          </form>
          <p>&nbsp; </p>
          <p>
            <? } } ?>
          </p>
<p>&nbsp;</p>
                  <div></div>
                </div>
              </div>


I, know its a bit messy but lets me see it and design it in Dreamweaver

Any way, for the comment system for users, I want it to show their avatar as well, which is stored in the users table. How would one do this.

I did think of it submitting the avatar along with the post but then it wouldnt update if the user would to change their avatars :\

Any helps???

Short of deleting, how do I comment out code like this :

<!-- IF not S_DISPLAY_RECENT -->
    <!-- INCLUDE portal/block/recent.html -->
<!-- ENDIF -->

Nesting <!-- -->
/*...*/
//

do not work.

Thanks