GMWeb/www/API/v1/comment.php

<?php
    // Gasteizko Margolariak API v1 //
    
    //Posible comment target
    define('TARGET_PHOTO', 'photo');
    define('TARGET_POST', 'post');
    define('TARGET_ACTIVITY', 'activity');
    
    //Default target
    define('DEF_TARGET', TARGET_ALL);
        
    //$_GET valid parameters
    define('GET_CLIENT', 'client');
    define('GET_USER', 'user');
    define('GET_TARGET', 'target');
    define('GET_ID', 'id');
    define('GET_PERMALINK', 'permalink');
    define('GET_TEXT', 'text');
    define('GET_USERNAME', 'username');
    
    /****************************************************
    * This function is called from almost everywhere at *
    * the beggining of the page. It initializes the     *
    * session variables, connect to the db, enabling    *
    * the variable $con for futher use everywhere in    *
    * the php code, and populates the arrays $user      *
    * and $permission, with info about the user.        *
    *                                                   *
    * @return: (db connection): The connection handler. *
    ****************************************************/
    function startdb(){
        //Include the db configuration file. It's somehow like this
        /*
        <?php
            $host = 'XXXX';
            $db_name = 'XXXX';
            $username_ro = 'XXXX';
            $username_rw = 'XXXX';
            $pass_ro = 'XXXX';
            $pass_rw = 'XXXX';
        ?>
        */
        include('../../.htpasswd');
        
        //Connect to to database
        $con = mysqli_connect($host, $username_rw, $pass_rw, $db_name);
        
        //Set encoding options
        mysqli_set_charset($con, 'utf-8');
        header('Content-Type: text/html; charset=utf8');
        mysqli_query($con, 'SET NAMES utf8;');
        
        //Return the db connection
        return $con;
    }
    
    //Connect to the database
    $con = startdb('rw');
    
    //Get data from URL
    $client = mysqli_real_escape_string($con, $_GET[GET_CLIENT]);
    $user = mysqli_real_escape_string($con, $_GET[GET_USER]);
    $target = strtolower(mysqli_real_escape_string($con, $_GET[GET_TARGET]));
    $id = strtolower(mysqli_real_escape_string($con, $_GET[GET_ID]));
    $permalink = strtolower(mysqli_real_escape_string($con, $_GET[GET_PERMALINK]));
    $ink = strtolower(mysqli_real_escape_string($con, $_GET[GET_PERMALINK]));
    $permalink = strtolower(mysqli_real_escape_string($con, $_GET[GET_PERMALINK]));
    $username = mysqli_real_escape_string($con, $_GET[GET_USERNAME]);
    $text = mysqli_real_escape_string($con, $_GET[GET_TEXT]);
    
    //Validate data
    if (strlen($client) < 1){
        //Bad request
        http_response_code(400);
        exit();
    }
    if (strlen($user) < 1){
        $user = '';
    }
    if (strlen($target) < 1){
        //Bad request
        http_response_code(400);
        exit();
    }
    if ($target != TARGET_PHOTO && $target != TARGET_POST && $target != TARGET_ACTIVITY){
        //Bad request
        http_response_code(400);
        exit();
    }
    if (strlen($username) < 1){
        //Bad request
        http_response_code(400);
        exit();
    }
    
    
    //Check id and/or permalink. Several cases:
    
    //1st case: id and permalink empty: Error.
    if (strlen($id) < 1 && strlen($permalink) < 1){
        //Bad request
        http_response_code(400);
        exit();
    }
    
    //2nd case: Comment for post, permalink and no id.
    elseif ($target == TARGET_POST && strlen($id) < 1 && strlen($permalink) >= 1){
    
        //Check if post exists...
        $q = mysqli_query($con, "SELECT id, comments FROM post WHERE visible = 1 AND permalink = '$permalink';");
        if (mysqli_num_rows($q) == 0){
            //Bad request
            http_response_code(400);
            exit();
        }
        else{
        
            //... and if it does, check if can be commented.
            $r = mysqli_fetch_array($q);
            $item_id = $r['id'];
            if ($r['comments'] != 1){
                //'Forbidden' status code
                http_response_code(403);
                exit();
            }
        }
    }
    
    //3rd case: Comment for post, id and no permalink.
    elseif ($target == TARGET_POST && strlen($id) >= 1 && strlen($permalink) < 1){
    
        //Check if post exists...
        $q = mysqli_query($con, "SELECT id, comments FROM post WHERE visible = 1 AND id = $id;");
        if (mysqli_num_rows($q) == 0){
            //Bad request
            http_response_code(400);
            exit();
        }
        else{
        
            //... and if it does, check if can be commented.
            $r = mysqli_fetch_array($q);
            $item_id = $r['id'];
            if ($r['comments'] != 1){
                //'Forbidden' status code
                http_response_code(403);
                exit();
            }
        }
    }
    
    //4th case: Comment for post, permalink and id.
    elseif ($target == TARGET_POST && strlen($id) >= 1 && strlen($permalink) >= 1){
    
        //Check if post exists...
        $q = mysqli_query($con, "SELECT id, comments FROM post WHERE visible = 1 AND permalink = '$permalink' AND id = $id ;");
        if (mysqli_num_rows($q) == 0){
            //Bad request
            http_response_code(400);
            exit();
        }
        else{
        
            //... and if it does, check if can be commented.
            $r = mysqli_fetch_array($q);
            $item_id = $r['id'];
            if ($r['comments'] != 1){
                //'Forbidden' status code
                http_response_code(403);
                exit();
            }
        }
    }
    
    //5th case: Comment for photo, permalink and no id.
    elseif ($target == TARGET_PHOTO && strlen($id) < 1 && strlen($permalink) >= 1){
    
        //Check if photo exists.
        $q = mysqli_query($con, "SELECT id FROM photo WHERE approved = 1 AND permalink = '$permalink';");
        if (mysqli_num_rows($q) == 0){
            //Bad request
            http_response_code(400);
            exit();
        }
        else{
            $item_id = $r['id'];
        }
    }
    
    //6th case: Comment for photo, id and no permalink.
    elseif ($target == TARGET_PHOTO && strlen($id) >= 1 && strlen($permalink) < 1){
    
        //Check if photo exists.
        $q = mysqli_query($con, "SELECT id FROM photo WHERE approved = 1 AND id = $id;");
        if (mysqli_num_rows($q) == 0){
            //Bad request
            http_response_code(400);
            exit();
        }
        else{
            $item_id = $r['id'];
        }
    }
    
    //7th case: Comment for photo, permalink and id.
    elseif ($target == TARGET_PHOTO && strlen($id) >= 1 && strlen($permalink) >= 1){
    
        //Check if photo exists.
        $q = mysqli_query($con, "SELECT id FROM photo WHERE approved = 1 AND permalink = '$permalink' AND id = $id;");
        if (mysqli_num_rows($q) == 0){
            //Bad request
            http_response_code(400);
            exit();
        }
        else{
            $item_id = $r['id'];
        }
    }
    
    //8nd case: Comment for activity, permalink and no id.
    elseif ($target == TARGET_ACTIVITY && strlen($id) < 1 && strlen($permalink) >= 1){
    
        //Check if activity exists...
        $q = mysqli_query($con, "SELECT id, comments FROM activity WHERE visible = 1 AND permalink = '$permalink';");
        if (mysqli_num_rows($q) == 0){
            //Bad request
            http_response_code(400);
            exit();
        }
        else{
        
            //... and if it does, check if can be commented.
            $r = mysqli_fetch_array($q);
            $item_id = $r['id'];
            if ($r['comments'] != 1){
                //'Forbidden' status code
                http_response_code(403);
                exit();
            }
        }
    }
    
    //9rd case: Comment for activity, id and no permalink.
    elseif ($target == TARGET_ACTIVITY && strlen($id) >= 1 && strlen($permalink) < 1){
    
        //Check if activity exists...
        $q = mysqli_query($con, "SELECT id, comments FROM activity WHERE visible = 1 AND id = $id;");
        if (mysqli_num_rows($q) == 0){
            //Bad request
            http_response_code(400);
            exit();
        }
        else{
        
            //... and if it does, check if can be commented.
            $r = mysqli_fetch_array($q);
            $item_id = $r['id'];
            if ($r['comments'] != 1){
                //'Forbidden' status code
                http_response_code(403);
                exit();
            }
        }
    }
    
    //10th case: Comment for activity, permalink and id.
    elseif ($target == TARGET_ACTIVITY && strlen($id) >= 1 && strlen($permalink) >= 1){
    
        //Check if activity exists...
        $q = mysqli_query($con, "SELECT id, comments FROM activity WHERE visible = 1 AND permalink = '$permalink' AND id = $id ;");
        if (mysqli_num_rows($q) == 0){
            //Bad request
            http_response_code(400);
            exit();
        }
        else{
        
            //... and if it does, check if can be commented.
            $r = mysqli_fetch_array($q);
            $item_id = $r['id'];
            if ($r['comments'] != 1){
                //'Forbidden' status code
                http_response_code(403);
                exit();
            }
        }
    }
    
    //If code gets here, there were no errors. Build query.
    $query = "INSERT INTO ";
    $section = "";
    switch ($target){
        case TARGET_POST:
            $query = $query . "post_comment (post";
            $section = "blog";
            break;
        case TARGET_PHOTO:
            $query = $query . "photo_comment (photo";
            $section = "gallery";
            break;
        case TARGET_ACTIVITY:
            $query = $query . "activity_comment (activity";
            $section = "activity";
            break;
    }
    $query = $query . ", text, username, app) VALUES ($item_id, \"$text\", \"$username\", \"client\");";
    //echo($query);
    mysqli_query($con, $query);
    mysqli_query($con, "UPDATE version SET version = version + 1 WHERE section = '$section';");

?>