[UberCMS] News Comment System

Hello all
I have news comment system of phpretro converted to ubercms.
He does not see the errors, for example if you are not logged in, you can not comment, but then there is no error.
Some things are dutch.


Screen:

Spoiler:

http://www.ferbo.nl/images/news%20comment.PNG

comp-newsarticle.tpl

PHP Code:

---

<?php
$_SESSION['id'] = $users->GetUserVar(USER_ID, 'id'); 
?>
<div class="habblet-container ">        
<div class="cbb clearfix notitle "> 
    
                            
    <div id="article-wrapper"> 
    
        <h2>%news_article_title%</h2> 
        
        <div class="article-meta">
        <?php if ($news_article_id > 0) { ?>
            %news_article_date%
            %news_category%
        <?php } ?> 
        </div> 
        
        <?php if (strlen(trim($news_article_summary)) > 0) { ?>        
        <p class="summary">
        
            %news_article_summary%
        
        </p> 
        <?php } ?>
        
        <div class="article-body"> 
        
            %news_article_body%
        
        </div>
        
        <?php if ($news_article_id > 0) { ?>
        <script type="text/javascript" language="Javascript"> 
            document.observe("dom:loaded", function() {
                $$('.article-images a').each(function(a) {
                    Event.observe(a, 'click', function(e) {
                        Event.stop(e);
                        Overlay.lightbox(a.href, "Image is loading");
                    });
                });
                
                $$('a.article-%news_article_id%').each(function(a) {
                    a.replace(a.innerHTML);
                });
            });
        </script> 
        <?php } ?>

    </div>    
    
</div>
</div>
<?php
if(isset($_POST['post_comment']))
  $posted_on = date("M j, Y g:i A");
 if (! isset($_POST['comment'])) {
  $_POST['comment'] = '';  // nu bestaat de variabele ten minste
}

$comment = strip_tags ($_POST['comment']);
if($comment == NULL){
    $error_message = 'You have left a field empty.<br /><br />';
  }else{
if (LOGGED_IN)
{
    mysql_query("INSERT INTO site_news_comments (article, userid, comment, posted_on) VALUES ('".$news_article_id."', '".$_SESSION['id']."', '".$comment."', '".$posted_on."');");
    $error_message = 'You have successfully left a comment.<br /><br />';
  }
}
?> 

<div class="habblet-container "> 
  <div class="cbb clearfix notitle "> 
    <div id="article-wrapper"><h2>Plaats Reactie</h2> 
      <div class="article-meta"></div> 
      <div class="article-body">  
        <form action="" method="post"> 
        <textarea name="comment" maxlength="500"></textarea><br /><br /> 
        <input type="submit" name="post_comment" value="Plaats Reactie" /> 
        </form>
      </div> 
    </div> 
  </div> 
</div> 
<style type="text/css">
input[type="text"], input[type="password"] {
  background-color: #F1F1F1;
  border: 1px solid #999999;
  width: 175px;
  padding: 5px;
  font-family: verdana;
  font-size: 10px;
  color: #666666;
}
input[type="submit"] {
  background-color: #F1F1F1;
  border: 1px solid #999999;
  padding: 5px;
  font-family: verdana;
  font-size: 10px;
  color: #666666;
}
textarea {
  background-color: #F1F1F1;
  border: 1px solid #999999;
  padding: 5px;
  width: 517px;
  height: 70px;
  font-family: verdana;
  font-size: 10px;
  color: #666666;
}
select {
  background-color: #F1F1F1;
  border: 1px solid #999999;
  padding: 5px;
  font-family: verdana;
  font-size: 10px;
  color: #666666;
}
</style> 
<?php 
$getComments = mysql_query("SELECT * FROM site_news_comments WHERE article = '".$news_article_id."' ORDER by id DESC");
?>
<div class="habblet-container "> 
  <div class="cbb clearfix notitle "> 
    <div id="article-wrapper"><h2>Reacties (<?php echo mysql_num_rows($getComments); ?>)</h2> 
      <div class="article-meta"></div> 
      <div class="article-body"> 
        <?php 
        if(mysql_num_rows($getComments) == 0){ 
          echo 'Sorry, er zijn nog geen Reacties geplaatst!'; 
        }else{ 
          echo '<table width="528px">'; 
          while($Comments = mysql_fetch_array($getComments)){ 
          $getUserInfo = mysql_query("SELECT * FROM users WHERE id = '".$Comments['userid']."'"); 
          $userInfo = mysql_fetch_array($getUserInfo); 
                  echo ' 
                  <tr> 
                    <td width="90px" valign="top"> 
                      <div style="float:left"><img src="http://www.habbo.com/habbo-imaging/avatarimage?figure='.$userInfo['look'].'&size=b&direction=2&head_direction=3&gesture=sml&size=m"></div> 
                      '; 
                      if($userInfo['rank'] > 8){ 
                        echo '<div style="position: absolute; z-index:1"><img src="http://www.ferbo.nl/c_images/album1584/AD1.gif"></div>'; 
                     }
                 echo ' 
                </td> 
                    <td width="427px" valign="top"> 
                      <strong>RE: %news_article_title%</strong><br /><br />'.$Comments['comment'].' 
                    </td> 
                  </tr> 
          <tr> 
                    <td width="90px" valign="top"> 
                    </td> 
            <td width="427px" align="right"> 
              <i>Geplaatst door: <strong><a href="#">'.$userInfo['username'].'</a></strong> op '.$Comments['posted_on'].'</i><br /><br /> 
            </td> 
          </tr>'; 
          } 
          echo '</table>'; 
        } 
        ?> 
      </div> 
    </div> 
  </div> 
</div>
</div>
                <script type="text/javascript">if (!$(document.body).hasClassName('process-template')) { Rounder.init(); }</script>

---

Sql:

PHP Code:

---

CREATE TABLE IF NOT EXISTS `site_news_comments` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `article` int(11) NOT NULL,
  `userid` int(11) NOT NULL,
  `comment` varchar(500) NOT NULL,
  `posted_on` varchar(150) NOT NULL DEFAULT '',
  PRIMARY KEY (`id`)
) ENGINE=MyISAM  DEFAULT CHARSET=latin1 AUTO_INCREMENT=294 ; 


---

Credits:
70% for Rastalulz for PhpRetro version.
30% for me

Greetz Efferinie


P.S Ideas are welcome :)

exploits :D

Haha. Dream on good kid.

1. its in dutch
2. stolen bcouse you say my hotel and copyd about 80% -,- (within this)
3. only right point is that u didnt forget to give rastalulz copyrights ;)

Quote:

---

Originally Posted by toperwin

1. its in dutch
2. stolen bcouse you say my hotel and copyd about 80% -,- (within this)
3. only right point is that u didnt forget to give rastalulz copyrights ;)

---

Jealous?

Btw, has nowhere © Rastalulz put down, and I have given him credits.

Marvellous i'm love the release...

Thanks for sharing ;D

Thanks, searched for this.
Don't care if it's stolen, couldn't found it.

Cya'
HabMoon

Quote:

---

Originally Posted by toperwin

You mean thanks for stealing? he stole the script from me and davidaap -,-

---

Childish guy hahah >_ <

Quote:

---

Originally Posted by habmoon

Thanks, searched for this.
Don't care if it's stolen, couldn't found it.

Cya'
HabMoon

---

efferinie is the guy from ferbo ;)

Don't use this, unless you wanna have an hacked hotel :)

Quote:

---

Originally Posted by davidaap

efferinie is the guy from ferbo ;)

[dutch]je weet wel die gast die al je teksten en badges jatten en ook de index ripte van epichabbo net zo als jij en nee daar heb je geen afspraak mee ik heb het zelf nagevraagt :D[/dutch]

---

I know he is? We talked that stuff out.
It's only noobisch from you to go off-topic now and that you want me to give bad comments, idc where he got this from and idc if he says its his, or not from you. And tbh, why would they say they give stuff to a retro when they are agains't them, hello habbo noobs? Anyway, don't go off-topic.

And i think my hotel gets hacked than @PE.

Again; nice release.

Oh, Look at all the lovely SQL injections!

Quote:

---

Originally Posted by LMC

Oh, Look at all the lovely SQL injections!

---

Yeah, and did u already seen the XSS too? use </div> and whole news is away ;D

Sorry Can I get this all Right..

Someone stole from someone, but were stealing from Habbo? right. so non of you have a say... the comment script is simple to code if you ripp it from rastas file.. just convert it to uber coding....

Anyways nice release, I probably won't use it in my life-time :P