View file loads/inc/komm.php

<?php

if (function_exists('iconv')) {
    $jfile = iconv('windows-1251', 'utf-8', $file);
} else {
    $jfile = $file;
}

$set['title'] = "Комментарии - $name2";
include_once H . 'sys/inc/thead.php';

if (isset($_POST['msg']) && isset($user)) {
    $msg = $_POST['msg'];
    $mat = antimat($msg);

    if ($mat) {
        $err[] = 'В тексте сообщения обнаружен мат: ' . $mat;
    }

    if (utf8_strlen($msg) > 1024) {
        $err = lang('Сообщение слишком длинное');
    } elseif (utf8_strlen($msg) < 2) {
        $err = lang('Короткое сообщение');
    } elseif (mysql_result(mysql_query("SELECT COUNT(*) FROM `loads_komm` WHERE `file` = '$jfile' AND `path` = '/$l/' AND `id_user` = '$user[id]' AND `msg` = '" . mysql_real_escape_string($msg) . "' LIMIT 1"), 0) != 0) {
        $err = lang('Ваше сообщение повторяет предыдущее');
    } elseif (!isset($err)) {
        mysql_query("INSERT INTO `loads_komm` (`id_user`, `time`, `msg`, `file`, `path`) values('$user[id]', '$time', '" . mysql_real_escape_string($msg) . "', '$jfile', '/$l/')");
        mysql_query("UPDATE `user` SET `money` = '" . ($user['money'] + 3) . "' AND `activity` = '" . ($user['activity'] + 2) . "' WHERE `id` = '$user[id]' LIMIT 1");

        $_SESSION['message'] = lang('Сообщение опубликовано');

        header("Location: ?komm&d=$l&f=$file&");
        exit();
    }
}

if (isset($_GET['del']) && mysql_result(mysql_query("SELECT COUNT(*) FROM `loads_komm` WHERE `id` = '" . intval($_GET['del']) . "'"), 0) == 1) {
    $post = mysql_fetch_assoc(mysql_query("SELECT * FROM `loads_komm` WHERE `id` = '" . intval($_GET['del']) . "' LIMIT 1"));
    $ank = get_user($post['id_user']);
    if (isset($user) && ($user['level'] > $ank['level'] || $user['level'] != 0 && $user['id'] == $ank['id'])) {
        mysql_query("DELETE FROM `loads_komm` WHERE `id` = '$post[id]'");
        $_SESSION['message'] = lang('Сообщение удалено');

        header("Location: ?komm&d=$l&f=$file&");
        exit();
    }
}

err();
aut();

$k_post = mysql_result(mysql_query("SELECT COUNT(*) FROM `loads_komm` WHERE `file` = '$jfile' AND `path` = '/$l/'"), 0);
$k_page = k_page($k_post, $set['p_str']);
$page = page($k_page);
$start = $set['p_str'] * $page - $set['p_str'];

if ($k_post == 0) {
    $doc->NoResult();
}

$q = mysql_query("SELECT * FROM `loads_komm` WHERE `file` = '$jfile' AND `path` = '/$l/' ORDER BY id DESC LIMIT $start, $set[p_str]");
while ($post = mysql_fetch_assoc($q)) {
    $ank = get_user($post['id_user']);

    echo "<table class='list-group-item-komm'><tr><td class='icon14'>";
    avatar($ank['id'], '40', 'border-radius: 2px;');
    echo "</td><td class='null'>";
    if (isset($user) && ($user['level'] > $ank['level'] || $user['level'] != 0 && $user['id'] == $ank['id'])) {
        echo "<span style='float: right'>";
        echo "<a href='/loads/?komm&amp;d=$l&amp;f=$jfile&amp;del=$post[id]&amp;page=$page' class='hint--left' data-hint='" . lang('Удалить комментарий') . "'><i class='fa fa-trash-o'></i></a>\n";
        echo "</span>";
    }
    echo user($ank['id']) . " <small style='color: grey;'>" . date::time($post['time']) . "</small><br />\n";

    echo toOutput($post['msg']) . "<br />\n";

    echo "</td></tr></table>\n";
}

if ($k_page > 1) {
    str("?komm&amp;" . url("d=$l&amp;f=$file") . "&amp;", $k_page, $page);
}

if (isset($user)) {
    echo "<form method=\"post\" class='list-group-item' name='message' action=\"?komm&amp;" . url("d=$l&amp;f=$file") . "&amp;\">\n";
    echo auto_bb("message", "msg");
    echo "<textarea placeholder='" . lang('Введите сообщение') . "...' name='msg' class='form-control'></textarea><br />";

    $doc->Button('btn btn-primary btn-sm', null, 'pencil', 'Опубликовать');
    echo "</form>\n";
}

echo "<div class='list-group-item'>";
echo "<a href='?" . url("d=$l&amp;scr=1&amp;f=$file") . "'><i class='fa fa-arrow-left'></i> К описанию файла</a><br />\n";
echo "</div>\n";

include_once H . 'sys/inc/tfoot.php';
?>