<?php
include("includes/global.php");

$p = @$_GET['p'];
if ($p == "") $p = 1;

$id = @$_GET['id'];
$do = @$_GET['do'];

if (!$id) {
 header("Location: index.php");
exit;
}

if (!$userInfo['loggedin']) {
 header("Location: login.php?redir=reply.php?id={$id}");
exit;
}

$query = mysqli_query($connection,"SELECT * FROM `threads` WHERE id='$id'");
$q = mysqli_fetch_array($query);
$query2 = mysqli_query($connection,"SELECT * FROM `forums` WHERE id='{$q['inForum']}'");
$q2 = mysqli_fetch_array($query2);
$locked = $q2['locked'];

if (!$q) {
 header("Location: index.php");
exit;
}

if ($locked && @$userInfo['title'] != "Administrator") {
 header("Location: index.php");
exit;
}

$pageInfo['title'] = "Reply";
$pageInfo['homelink'] .= " -> <a href=\"viewforum.php?id={$q2['id']}\">{$q2['name']}</a>";
$pageInfo['homelink'] .= " -> <a href=\"viewthread.php?id={$q['id']}\">{$q['title']}</a>";
$pageInfo['homelink'] .= " -> <a href=\"reply.php?id={$q['id']}\">Reply</a>";

if ($do == "") {
 fetchTemplate("header");
 if (!@$_POST['title']) {
  @$_POST['title'] = "Re: {$q['title']}";
 }
 $action = "reply.php?id={$id}&do=reply&p={$p}";
 fetchTemplate("postform");
 fetchTemplate("footer");
}
else if ($do == "reply") {
 $title = @$_POST['title'];
 $post = @$_POST['post'];
 if ($title && $post) {
  $title = htmlspecialchars($title);
  $post = htmlspecialchars($post);
  $title = stripslashes($title);
  $post = stripslashes($post);
  $title = format_chars($title);
  $post = format_chars($post);
  $date = time();
  $query = mysqli_query($connection,"INSERT INTO `posts` VALUES ('','$title','{$userInfo['id']}','$date','{$q['inForum']}','$id','$post')");
  $lastID = mysqli_insert_id($connection);
  if ($query) {
   $query = mysqli_query($connection,"SELECT `inForum` FROM `threads` WHERE id='$id'");
   $q = mysqli_fetch_row($query);
   $query = mysqli_query($connection,"SELECT * FROM `forums` WHERE id='$q[0]'");
   $q = mysqli_fetch_array($query);
   $posts = $q['posts'] + 1;
   mysqli_query($connection,"UPDATE `forums` SET posts='$posts' WHERE id='{$q['id']}'");
   $userPosts = $userInfo['posts'] + 1;
   mysqli_query($connection,"UPDATE `users` SET posts='$userPosts' WHERE id='{$userInfo['id']}'");
   header("Location: viewthread.php?id={$id}&p={$p}#post{$lastID}");
  }
  else {
   $title = stripslashes($title);
   $post = stripslashes($post);
   fetchTemplate("header");
?>
<p align=center><font color=red><b>Error:</b> Unable to make new reply. Please try again later.<br /></font></p>
<form method="post" action="reply.php?id=<?php echo "{$id}&p={$p}"; ?>">
 <input type="hidden" name="title" value="<?php echo $title; ?>">
 <input type="hidden" name="post" value="<?php echo $post; ?>">
 <input type="submit" value="Back">
</form>
<?php
   fetchTemplate("footer");
  }
 }
 else {
  fetchTemplate("header");
?>
<p align=center><font color=red>Please fill in all of the fields.<br /></font></p>
<form method="post" action="reply.php?id=<?php echo "{$id}&p={$p}"; ?>">
 <input type="hidden" name="title" value="<?php echo $title; ?>">
 <input type="hidden" name="post" value="<?php echo $post; ?>">
<p align=center> <input type="submit" value="Back">  </p>
</form>
<?php
  fetchTemplate("footer");
 }
}
?>