How do I approve pending records? - php

Question

I am working on a video-hosting website in which user-uploaded videos (called "answers" as they will be made in response to requests for help in hobby-making) are put into a pending list for a web administrator to examine and decide whether to approve for public viewing or not.
All video records have a boolean piece of data called "approved" that is set to either true ('1') or false ('0').
What I'm having trouble with is the actual approval process. No matter what I do, I can never get to set on the video's "approved" status.
Here is the code I have written...
answer.php (Main video page)
<a class="btn btn-success btn-lg btn-block" href="<?php echo url_for('/approve.php?id=' . h(u($answer['id']))); ?>"><i class="mr-2 fas fa-check fa-2x"></i>Approve</a>
approve.php
if(!isset($_GET['id'])) {
redirect_to(url_for('/pending.php'));
}
$id = $_GET['id'];
if(is_post_request()) {
$answer = [];
$answer['id'] = $id;
$answer['approved'] = $_POST['approved'];
$result = approve_answer($id);
$_SESSION['message'] = '<div class="text-success">The answer was successfully approved and ready for public viewing.</div>';
redirect_to(url_for('/pending.php'));
} else {
$answer = find_answer_by_id($id);
$user = find_user_by_id($answer['user_id']);
}
?>
<?php $page_title = 'Confirm Approval'; ?>
<?php include(SHARED_PATH . '/public_header.php'); ?>
<div class="container my-2">
<div class="my-2">
<a class="back-link my-2" href="<?php echo url_for('/answer.php?id=' . h(u($answer['id']))); ?>"><i class="mr-2 fas fa-arrow-circle-left fa-2x"></i> Back to Answer</a>
</div>
<div class="answer approve">
<h1>Confirm Approval</h1>
<p>Are you sure you want to approve this answer?</p>
<p class="item"><strong><?php echo h($answer['title']); ?></strong> by <emphasis><?php echo h($user['username']); ?></emphasis></p>
<p><italics><?php echo h($answer['content']); ?></italics>
<form action="<?php echo url_for('/approve.php?id=' . h(u($answer['id']))); ?>" method="post">
<div id="operations">
<input type="hidden" name="approved" value="1" />
<input class="btn btn-success btn-lg btn-block" type="submit" name="approved" id="approved" value="Confirm" />
</div>
</form>
</div>
</div><!-- container -->
function approve_answer (query_functions.php)
function approve_answer($answer) {
global $db;
$errors = validate_answer($answer);
if(!empty($errors)) {
return $errors;
}
$sql = "UPDATE answers SET ";
$sql .= "approved='" . db_escape($db, '1') . "', ";
$sql .= "WHERE id='" . db_escape($db, $answer['id']) . "' ";
$sql .= "LIMIT 1";
$result = mysqli_query($db, $sql);
// For UPDATE statements, $result is true/false
if($result) {
return true;
} else {
// UPDATE failed
echo mysqli_error($db);
db_disconnect($db);
exit;
}
}
So where have I gone wrong?

Answer 1

Replace below code to query.
$sql = "UPDATE answers SET ";
$sql .= "approved='" . db_escape('1') . "', ";
$sql .= "WHERE id='" . db_escape($answer['id']) . "' ";
$sql .= "LIMIT 1";

Answer 2

if(!isset($_GET['id'])) {
redirect_to(url_for('/pending.php'));
}
if(is_post_request()) {
$result = approve_answer($_POST['id']);
$_SESSION['message'] = '<div class="text-success">The answer was successfully approved and ready for public viewing.</div>';
redirect_to(url_for('/pending.php'));
} else {
$answer = find_answer_by_id($_GET['id']);
$user = find_user_by_id($answer['user_id']);
}
?>
<?php $page_title = 'Confirm Approval'; ?>
<?php include(SHARED_PATH . '/public_header.php'); ?>
<div class="container my-2">
<div class="my-2">
<a class="back-link my-2" href="<?php echo url_for('/answer.php?id=' . h(u($answer['id']))); ?>"><i class="mr-2 fas fa-arrow-circle-left fa-2x"></i> Back to Answer</a>
</div>
<div class="answer approve">
<h1>Confirm Approval</h1>
<p>Are you sure you want to approve this answer?</p>
<p class="item"><strong><?php echo h($answer['title']); ?></strong> by <emphasis><?php echo h($user['username']); ?></emphasis></p>
<p><italics><?php echo h($answer['content']); ?></italics>
<form action="<?php echo url_for('/approve.php?id=' . h(u($answer['id']))); ?>" method="post">
<div id="operations">
<input type="hidden" name="id" value="<?php echo $_GET['id']; ?>" />
<input class="btn btn-success btn-lg btn-block" type="submit" name="approved" id="approved" value="Confirm" />
</div>
</form>
</div>
</div><!-- container -->
Query
$sql = "UPDATE answers SET ";
$sql .= "approved=1";
$sql .= "WHERE id='" . db_escape($db, $answer) . "' ";
You can try this code. I am still not sure where you are setting the value for $answer['user_id'] ? But this should solve your issue.