PHP Code:
$zco_notifier->notify('NOTIFY_HEADER_START_PRODUCT_REVIEWS_WRITE');
if (!$_SESSION['customer_id']) {
$_SESSION['navigation']->set_snapshot();
zen_redirect(zen_href_link(FILENAME_LOGIN, '', 'SSL'));
}
require(DIR_WS_MODULES . zen_get_module_directory('require_languages.php'));
$product_info_query = "SELECT p.products_id, p.products_model, p.products_image,
p.products_price, p.products_tax_class_id, pd.products_name
FROM " . TABLE_PRODUCTS . " p, " . TABLE_PRODUCTS_DESCRIPTION . " pd
WHERE p.products_id = :productsID
AND p.products_status = '1'
AND p.products_id = pd.products_id
AND pd.language_id = :languagesID";
$product_info_query = $db->bindVars($product_info_query, ':productsID', $_GET['products_id'], 'integer');
$product_info_query = $db->bindVars($product_info_query, ':languagesID', $_SESSION['languages_id'], 'integer');
$product_info = $db->Execute($product_info_query);
if (!$product_info->RecordCount()) {
zen_redirect(zen_href_link(FILENAME_PRODUCT_REVIEWS, zen_get_all_get_params(array('action'))));
}
$customer_query = "SELECT customers_firstname, customers_lastname, customers_email_address
FROM " . TABLE_CUSTOMERS . "
WHERE customers_id = :customersID";
$customer_query = $db->bindVars($customer_query, ':customersID', $_SESSION['customer_id'], 'integer');
$customer = $db->Execute($customer_query);
if (isset($_GET['action']) && ($_GET['action'] == 'process')) {
$rating = zen_db_prepare_input($_POST['rating']);
$review_text = zen_db_prepare_input($_POST['review_text']);
$error = false;
if (strlen($review_text) < REVIEW_TEXT_MIN_LENGTH) {
$error = true;
$messageStack->add('review_text', JS_REVIEW_TEXT);
}
if (($rating < 1) || ($rating > 5)) {
$error = true;
$messageStack->add('review_text', JS_REVIEW_RATING);
}
if ($error == false) {
if (REVIEWS_APPROVAL == '1') {
$review_status = '0';
} else {
$review_status = '1';
}
$sql = "INSERT INTO " . TABLE_REVIEWS . " (products_id, customers_id, customers_name, reviews_rating, date_added, status)
VALUES (:productsID, :customersID, :customersName, :rating, now(), " . $review_status . ")";
$sql = $db->bindVars($sql, ':productsID', $_GET['products_id'], 'integer');
$sql = $db->bindVars($sql, ':customersID', $_SESSION['customer_id'], 'integer');
$sql = $db->bindVars($sql, ':customersName', $customer->fields['customers_firstname'] . ' ' . $customer->fields[''], 'string');
$sql = $db->bindVars($sql, ':rating', $rating, 'string');
$db->Execute($sql);