Blog post ID is missing or invalid.
";
include 'footer.php';
exit;
}
// Use prepared statement for fetching blog post for security
$stmt_blog = $conn->prepare("SELECT id, title, content, cover_image, created_at FROM blogs WHERE id = ?");
if ($stmt_blog === false) {
echo "Database error preparing blog fetch: " . htmlspecialchars($conn->error) . "
";
include 'footer.php';
exit;
}
$stmt_blog->bind_param("i", $blog_id);
$stmt_blog->execute();
$result_blog = $stmt_blog->get_result();
if ($result_blog->num_rows === 0) {
echo "The requested blog post was not found.
";
include 'footer.php';
exit;
}
$blog_post = $result_blog->fetch_assoc();
$stmt_blog->close(); // Close statement as soon as results are fetched
// --- Generate a URL-friendly slug for the title parameter -----
// Ensure 'title' key exists before using it
$slug = strtolower(preg_replace('/[^A-Za-z0-9]+/', '-', trim($blog_post['title'] ?? 'untitled')));
// Generate the full URL for sharing (handles HTTP/HTTPS correctly)
$current_page_url = "http" . (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "s" : "") . "://{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";
// --- Handle Comment Submission ---------------------------------
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['submit_comment'])) {
// Retain submitted values for form persistence in case of errors
$author_name_input = $_POST['author_name'] ?? '';
$comment_text_input = $_POST['comment_text'] ?? '';
// CSRF Token Validation
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
$comment_status['type'] = 'error';
$comment_status['message'] = 'Security token mismatch. Please try again.';
} else {
$form_blog_id = (int) ($_POST['blog_id'] ?? 0); // Ensure it's an int and defaults to 0
$author_name = trim($author_name_input);
$comment_text = trim($comment_text_input);
// --- Server-side Validation ---
if ($form_blog_id !== $blog_post['id']) {
$comment_status['type'] = 'error';
$comment_status['message'] = 'Invalid blog ID for comment submission.';
} elseif (empty($author_name)) {
$comment_status['type'] = 'error';
$comment_status['message'] = "Please enter your name.";
} elseif (mb_strlen($author_name, 'UTF-8') > 255) { // Using mb_strlen for multi-byte character support
$comment_status['type'] = 'error';
$comment_status['message'] = "Your name is too long (max 255 characters).";
} elseif (empty($comment_text)) {
$comment_status['type'] = 'error';
$comment_status['message'] = "Please enter your comment.";
} elseif (mb_strlen($comment_text, 'UTF-8') > 5000) { // Limit comment length
$comment_status['type'] = 'error';
$comment_status['message'] = "Your comment is too long (max 5000 characters).";
} else {
// Sanitize inputs before insertion (though prepared statements handle SQL escaping, this cleans general data)
// Using filter_var for general string sanitization
$sanitized_author_name = filter_var($author_name, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
$sanitized_comment_text = filter_var($comment_text, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
// Prepare and bind parameters for comment insertion
$stmt_insert_comment = $conn->prepare("INSERT INTO comments (blog_id, author_name, comment_text) VALUES (?, ?, ?)");
if ($stmt_insert_comment === false) {
$comment_status['type'] = 'error';
$comment_status['message'] = 'Database error preparing comment insertion: ' . htmlspecialchars($conn->error);
error_log('Comment Insert Prepare Error: ' . $conn->error); // Log detailed error
} else {
$stmt_insert_comment->bind_param("iss", $form_blog_id, $sanitized_author_name, $sanitized_comment_text);
if ($stmt_insert_comment->execute()) {
$comment_status['type'] = 'success';
$comment_status['message'] = 'Your comment has been submitted successfully!';
// Clear form fields on success
$author_name_input = '';
$comment_text_input = '';
// Regenerate CSRF token after successful submission to prevent replay attacks
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
} else {
$comment_status['type'] = 'error';
$comment_status['message'] = 'Error submitting comment: ' . htmlspecialchars($stmt_insert_comment->error);
error_log('Comment Insert Execute Error: ' . $stmt_insert_comment->error); // Log detailed error
}
$stmt_insert_comment->close();
}
}
}
}
// --- Fetch Comments for this blog post -------------------------
$comments = [];
$stmt_fetch_comments = $conn->prepare("SELECT author_name, comment_text, created_at FROM comments WHERE blog_id = ? ORDER BY created_at DESC");
if ($stmt_fetch_comments === false) {
error_log('Database error preparing comment fetch: ' . $conn->error);
} else {
$stmt_fetch_comments->bind_param("i", $blog_id);
if ($stmt_fetch_comments->execute()) {
$comments_data = $stmt_fetch_comments->get_result();
while ($comment_row = $comments_data->fetch_assoc()) {
$comments[] = $comment_row;
}
} else {
error_log('Database error executing comment fetch: ' . $stmt_fetch_comments->error);
}
$stmt_fetch_comments->close();
}
// Close the database connection at the end of the script
$conn->close();
?>
![<?php echo htmlspecialchars($blog_post['title'] ?? 'Blog Post'); ?> Cover Image](/<?= ltrim(htmlspecialchars($blog_post['cover_image']), '/') ?>)
purify($blog_post['content']);
*
* If it's pure Markdown converted to HTML or trusted content,
* then direct output is fine as long as the source is secure.
* For this example, we assume content from a trusted source (admin editor)
* and do not apply htmlspecialchars to allow HTML formatting.
*/
echo $blog_post['content'] ?? 'No content available.';
?>
Comments ()
Leave a Comment