<?
session_start();
include '../admin/db.php';
if(!$_POST[id]) { header("Location: ".$basehttp."/"); exit(); } 
if(!$_POST[name]) { $_POST[name] = $_SESSION[username];  }
if(!$_POST[comment]) { exit(); }

$comment = mysql_real_escape_string(strip_tags($_POST[comment])); 
$name = mysql_real_escape_string(strip_tags($_POST[name])); 
$id = mysql_real_escape_string($_POST[id]); 

$now = time() - 60; 
$throttle = mysql_query("SELECT record_num FROM comments WHERE name = '$_SESSION[username]' AND content = '$id' AND timestamp > '$now'");
if(mysql_num_rows($throttle) > 0) {
	echo "You may only post a comment once every 60 seconds.<br>"; 
	exit(); 
}

$result = mysql_query("SELECT record_num FROM content WHERE record_num = '$id'");
if(mysql_num_rows($result) > 0) {
	mysql_query("INSERT INTO comments (userid, name, comment, content, timestamp, ip) VALUES ('$_SESSION[userid]', '$name','$comment','$id','".time()."','$_SERVER[REMOTE_ADDR]')");
	echo "Thank you! Your comment has been posted.<br>";
	exit();
}
else {
	exit(); 
}
?>