<?php
	require("./includes/header.php");

	$link = mysqli_connect("localhost", "mainuser", "gfdagfda", "osup2020");
	
	/*if(!preg_match("/^[0-9]+$/", $_GET['id'])){
		echo 'Invalid article id';
		exit;
	}*/
	$article_id = (int)$_GET['id'];
	
	/*$article_id = mysqli_real_escape_string($link, $_GET['id']);*/
	
	$sql = "SELECT content FROM articles WHERE id=".$article_id;
	
	$result = mysqli_query($link, $sql);
	$row = @mysqli_fetch_assoc($result);
	if(isset($row['content'])){
		echo '<p>'.$row['content'].'</p>';
	}
	else{
		echo 'Няма такава статия';
	}
?>
<h3>Отзив</h3>
<form action="articles.php?id=<?=$article_id?>" method="POST">
	<input id="name" type="text" name="name" placeholder="Име *" /><br />
	<input id="content" type="text" name="content" placeholder="Текст *"  onkeydown="return stopTab(event);" /><br />
	<input id="email" type="text" name="email" placeholder="Е-поща" />
	<input type="submit" name="submit" value="Дайте отзив" /><br />
	Полетата със * са задължителни
</form>
<script>
function stopTab(e){
	var evt = e || window.event;
	if(evt.keyCode === 9){
		return false;
	}
}
</script>
<?php
	if(!empty($_POST['email'])){
		echo 'Не попълвайте полето за електронна поща - то е за спиране на ботове!';
	}
	else if(isset($_POST['content']) && isset($_POST['name'])){
		$sql = "INSERT INTO feedback(article_id, content, name)
				VALUES(".$article_id.", '".mysqli_real_escape_string($link, $_POST['content'])."', '".mysqli_real_escape_string($link,$_POST['name'])."')";
		$result = @mysqli_query($link, $sql);
		echo 'Благодарим за вашия коментар!';
	}
	require("./includes/footer.php");
?>