<?php
function COMMENTS() {
	global $CONNECT, $Module, $Page, $Param;	
	
	if ($_SESSION['USER_LOGIN_IN'] != 1 and !$_SESSION['USER_LOGIN']) {
		/*Форма коментариев для гостей*/
$Avatar = 0; echo '<br/><a href="#login_form" style="width:80px;margin-left:50%;background: #133423;padding:0 5px 0 5px;border-radius:15px;border:2px solid #888">Войти</a>
<br/><br/><div><img src="/resource/avatar/'.$Avatar.'.jpg" width="80" height="74" alt="Аватар" align="left" id="avatar" style="cursor:pointer" />
        <form method="POST" action="/comments/add/module/'.$Page.'/id/'.$Param['id'].'">
	    <textarea id="message" name="text" placeholder="Текст сообщения" required></textarea>
		<br><input type="submit" name="enter" value="Отправить" style="margin-left:97px">
		<input type="hidden" name="user_id" value="'.$_SESSION['USER_ID'].'">
		</form>
		</div>
		<br><br>';
		}
		
/*Форма коментариев для пользователей*/
else {$Avatar = (empty($_SESSION['USER_AVATAR'])) ? 0 : $_SESSION['USER_AVATAR'].'/'.$_SESSION['USER_ID'];
          echo '<div><br><br>
			<ul id="soc"><li>
			<img src="/resource/avatar/'.$Avatar.'.jpg" width="80" height="74" alt="Аватар" align="left" id="avatar" style="cursor:pointer" />
                   <ul style="top:-48px"><li><div id="count" style="padding:5px 5px 24px 5px"> 
				   <a href="/profile" id="link">Профиль</a><br><a href="/account/logout" id="link">Выход</a>
            </li></ul>
			</li></ul>

             <form method="POST" action="/comments/add/module/'.$Page.'/id/'.$Param['id'].'">
			 <textarea id="message" name="text" placeholder="Текст сообщения" required></textarea>
			 <br><input type="submit" name="enter" value="Отправить" style="margin-left:97px">
			 <input type="hidden" name="user_id" value="'.$_SESSION['USER_ID'].'">
			</form></div><br><br>';
	    }

	$ID = ModuleID($Page);

	$Param['page'] = (!$Param['page']) ? 1 :  $Param['page'];
	
	// Это правильное использование структуры
	$sql = "
	SELECT 
		c.`id`, c.`text`, c.user_id,
		DATE_FORMAT(c.`date`, '%d.%m.%Y, %H:%i:%s') AS date,
		u.avatar, u.login, u.name, u.group
	FROM 
		`comments` AS c
	LEFT JOIN 
		`users` AS u ON u.id = c.user_id
	WHERE 
		c.`module` = $ID AND 
		c.`material` = '".$Param['id']."' 
	ORDER BY 
		c.`id` DESC
	";
	$Result = mysqli_query($CONNECT, $sql) or die( mysqli_error($CONNECT) );
	while ($Row = mysqli_fetch_assoc($Result)) {
		
		$Admin = '';
		if ($_SESSION['USER_ID'] == $Row['user_id'] OR $_SESSION['group'] == 2) 
			$Admin = ' [ <a href="/comments/control/action/edit/id/'.$Row['id'].'">Редактировать</a> ] [ <a href="/comments/control/action/delete/id/'.$Row['id'].'">Удалить</a> ]';
			
		// Если есть настройка позволяющая редактировать комментарии.
		if ($Row['id'] == $_SESSION['COMMENTS_EDIT']) 
			$Row['text'] = '
			<form method="POST" action="/comments/control">
				<textarea id="comedit" name="text" placeholder="Текст сообщения" required>'.$Row['text'].'</textarea>
				<br>
				<input type="submit" name="save" value="Сохранить"> 
				<input type="submit" name="cancel" value="Отменить">
			</form>
			';		
		
		
mysqli_query($CONNECT, "SELECT `id`, `name`, `email`, `regdate`, `group`, `avatar` FROM `users` WHERE `login` = '$Module'");

		$Avatar = (empty($Row['avatar'])) ? 0 : $Row['avatar'].'/'.$Row['user_id'];
		$profil = (empty($Row['name'])) ? 'Аноним' : '<a href="/adm-prof/'.$Row['login'].'">'.$Row['name'].'</a>';
		
		echo '
		<img src="/resource/avatar/'.$Avatar.'.jpg" width="60" height="60" alt="Аватар" align="left" id="avatar" />
		<div id="comments">
			<span>
				'.$profil.'
				<p>'.$Row['date'].$Admin.'</p>
			</span>
			<div>'.$Row['text'].'</div>
		</div>
		';
	}
}
?>

<?php 


if ($_POST['enter'] and $_POST['text']) {
	$_POST['text'] = FormChars($_POST['text']);
	$ID = ModuleID($Param['module']);
	if ($ID == 1) 
		$Table = 'publ';
	else 
		if ($ID == 2) 
			$Table = 'loads';
	
	$Row = mysqli_fetch_assoc(mysqli_query($CONNECT, 'SELECT `id` FROM `'.$Table.'` WHERE `id` = '.$Param['id']));
	if (!$Row['id']) 
		MessageSend(1, 'Материал не найден.', '/'.$Param['module']);
	$sql = "
	INSERT INTO 
		`comments`  
	SET
		`material` = ".$Param['id'].", 
		`module` = $ID, 
		`added` = '".$_SESSION[USER_LOGIN]."', 
		`text` = '".$_POST['text']."', 
		`date` = NOW(),
		`user_id` = '".(int)$_POST['user_id']."'
	";
	mysqli_query($CONNECT, $sql) or die( mysqli_error($CONNECT) );
	MessageSend(3, 'Комментарий добавлен.', '/'.$Param['module'].'/material/id/'.$Param['id']);
}
?>

<?php
if ($Param['action'] == 'delete') {
	mysqli_query($CONNECT, "DELETE FROM `comments` WHERE `id` = $Param[id]");
	MessageSend(3, 'Комментарий удален.');

} else if ($Param['action'] == 'edit') {
	$_SESSION['COMMENTS_EDIT'] = $Param['id'];
	exit(header('location: '.$_SERVER['HTTP_REFERER']));


	} else if ($_POST['save']) {
		mysqli_query($CONNECT, "UPDATE `comments` SET `text` = '$_POST[text]' WHERE `id` = $_SESSION[COMMENTS_EDIT]");
		unset($_SESSION['COMMENTS_EDIT']);
		MessageSend(3, 'Коментарий отредактирован.');		
	
		} else if ($_POST['cancel']) {
			unset($_SESSION['COMMENTS_EDIT']);
			MessageSend(3, 'Редактирование отмененно.');
		}
?>

id	int	AUTO_INCREMENT	
material	int
module      int
added	varchar(30)	
text	mediumtext	
date	datetime
user_id	int