diff --git a/add_review.php b/add_review.php
index 821c84c72a0cc31a8a26daeb2f8f5fd68638bcaf..6a95c74c1d4a621786c9fac4f5aaad46d8a972c0 100644
--- a/add_review.php
+++ b/add_review.php
@@ -1,44 +1,56 @@
-<?php
+<?php
+error_reporting(E_ALL);
+ini_set('display_errors', 1);
include 'components/connect.php';
+// ตรวจสอบว่าผู้ใช้ล็อกอินหรือไม่
+if (!isset($user_id) || empty($user_id)) {
+ die("Error: User is not logged in.");
+}
+
+// ตรวจสอบว่ามี get_id หรือไม่
if(isset($_GET['get_id'])){
$get_id = $_GET['get_id'];
}else{
- $get_id = '';
header('location:all_posts.php');
+ exit();
}
-if(isset($_POST['submit'])){
-
- if($user_id != ''){
-
- $id = create_unique_id();
- $title = $_POST['title'];
- $title = filter_var($title, FILTER_SANITIZE_STRING);
- $description = $_POST['description'];
- $description = filter_var($description, FILTER_SANITIZE_STRING);
- $rating = $_POST['rating'];
- $rating = filter_var($rating, FILTER_SANITIZE_STRING);
-
- $verify_review = $conn->prepare("SELECT * FROM `reviews` WHERE post_id = ? AND user_id = ?");
- $verify_review->execute([$get_id, $user_id]);
-
- if($verify_review->rowCount() > 0){
- $warning_msg[] = 'Your review already added!';
- }else{
- $add_review = $conn->prepare("INSERT INTO `reviews`(id, post_id, user_id, rating, title, description) VALUES(?,?,?,?,?,?)");
- $add_review->execute([$id, $get_id, $user_id, $rating, $title, $description]);
- $success_msg[] = 'Review added!';
- }
-
- }else{
- $warning_msg[] = 'Please login first!';
- }
-
+// ตรวจสอบว่าฟังก์ชัน create_unique_id() มีอยู่จริงหรือไม่
+if (!function_exists('create_unique_id')) {
+ function create_unique_id() {
+ return uniqid();
+ }
}
+// ตรวจสอบว่ามีการส่งแบบฟอร์มหรือไม่
+if(isset($_POST['submit'])) {
+ $id = create_unique_id();
+ $title = filter_var($_POST['title'], FILTER_SANITIZE_STRING);
+ $description = filter_var($_POST['description'], FILTER_SANITIZE_STRING);
+ $rating = filter_var($_POST['rating'], FILTER_SANITIZE_STRING);
+
+ // ตรวจสอบว่าตาราง reviews มีอยู่หรือไม่
+ $check_table = $conn->query("SHOW TABLES LIKE 'reviews'");
+ if ($check_table->rowCount() == 0) {
+ die("Error: Table 'reviews' does not exist in the database.");
+ }
+
+ // ตรวจสอบว่าผู้ใช้เคยรีวิวโพสต์นี้หรือไม่
+ $verify_review = $conn->prepare("SELECT * FROM `reviews` WHERE post_id = ? AND user_id = ?");
+ $verify_review->execute([$get_id, $user_id]);
+
+ if ($verify_review->rowCount() > 0) {
+ $warning_msg[] = 'Your review already added!';
+ } else {
+ $add_review = $conn->prepare("INSERT INTO `reviews` (id, post_id, user_id, rating, title, description) VALUES (?, ?, ?, ?, ?, ?)");
+ $add_review->execute([$id, $get_id, $user_id, $rating, $title, $description]);
+ $success_msg[] = 'Review added!';
+ }
+}
?>
+
<!DOCTYPE html>
<html lang="en">
<head>
@@ -46,21 +58,13 @@ if(isset($_POST['submit'])){
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>add review</title>
-
- <!-- custom css file link -->
<link rel="stylesheet" href="css/style.css">
-
</head>
<body>
-
-<!-- header section starts -->
-<?php include 'components/header.php'; ?>
-<!-- header section ends -->
-<!-- add review section starts -->
+<?php include 'components/header.php'; ?>
<section class="account-form">
-
<form action="" method="post">
<h3>post your review</h3>
<p class="placeholder">review title <span>*</span></p>
@@ -76,19 +80,17 @@ if(isset($_POST['submit'])){
<option value="5">5</option>
</select>
<input type="submit" value="submit review" name="submit" class="btn">
- <a href="view_post.php?get_id=<?= $get_id; ?>" class="option-btn">go back</a>
+ <a href="view_post.php?get_id=<?= htmlspecialchars($get_id); ?>" class="option-btn">go back</a>
</form>
-
</section>
-<!-- add review section ends -->
-<!-- sweetalert cdn link -->
<script src="https://cdnjs.cloudflare.com/ajax/libs/sweetalert/2.1.2/sweetalert.min.js"></script>
-
-<!-- custom js file link -->
<script src="js/script.js"></script>
-<?php include 'components/alers.php'; ?>
+<?php
+// ปิดการ include ชั่วคราวเพื่อแก้ปัญหาไฟล์ไม่เจอ
+// include 'components/alerts.php';
+?>
</body>
-</html>
\ No newline at end of file
+</html>