i am making an comment section in php under my file upload - php

Question

$query_file="SELECT * FROM files";
$result_file = mysql_query($query_file);
if ($result_file) {
while ($row= mysql_fetch_array($result_file))
{
if($row[file_type] == "image"){
echo" <image src=".$row['file_location']."width=340 height=240>";
echo "</image><br>";
echo "</br>";
echo $row['file_description'];
echo "</br>";
}
if (isset($_POST['post_comment']) and !empty($_POST['write_comment'])) {
$comment_description = trim(htmlentities(strip_tags(mysql_real_escape_string($_POST['write_comment'])))); {
if (!$file_id=mysql_query("SELECT file_id FROM files WHERE file_id='$id' ")) {
echo 'Invalid file ID';
} else {
$query=mysql_query("INSERT INTO comments VALUES ('','$user','$fileid',NOW(),'$comment_description')");
}
}
}
echo "
<div style='float: left; width: 100%;''>
<form action='' method='post'>
<textarea name='write_comment' rows='3' cols='50' style='float: left;'></textarea>
<input type='submit' name='post_comment' id='' value='Comment' style='height: 40kpx; float: left;''d>
</form>
</div>
";
}
}
else{
echo mysql_error();
}
this is my code for making comment section but it is not aking the particular fileid which i have uploaded
how should i correct it
and my sql table for commment...
comments_id,comment_by,comment_on,comment_date,comment_description
and my files table
(id, file_title, file_description, file_keywords, privacy, uploaded_by, date_uploaded, md5, views, file_id, file_md5, file_location, file_type)

Answer 1

Due to the nature of the original code and the lack of clarity on what the actual question is the following may or may not be what you were trying to do.
There were many errors in the original code - some of them PHP, the others basic HTML faults. I tried to identify and fix them though I make no guarantees they are all fixed.
The form that allows the user to add a comment has a hidden field that contains the ID for the image. That ID is POSTed along with the comment and is inserted using the code at the top ~ but again - where is $user defined?
The code here is vulnerable to sql injection but as you have stated you are going to change this to mysqli then that is irrelevant perhaps.
<?php
/*
This handles the insertion of the comment
*/
if( $_SERVER['REQUEST_METHOD']=='POST' && isset( $_POST['write_comment'], $_POST['post_comment'], $_POST['file_id'] ) ){
$fileid=$_POST['file_id'];
$comment=$_POST['write_comment'];
$user='GERONIMO'; /* WHERE IS $user DEFINED????? */
$query=mysql_query( "INSERT INTO comments VALUES ( '', '$user', '$fileid', NOW(), '$comment_description' )" );
}
?>
<?php
/*
This is to display the image and
the form so that a user can add a
comment
*/
$sql='SELECT * FROM files';
$result = mysql_query( $sql );
if ( $result ) {
while( $row= mysql_fetch_array( $result ) ) {
if( $row['file_type'] == "image" ){
echo "
<div style='float:left; width:100%;'>
<img src='{$row['file_location']}' width=340 height=240 />
<p>
{$row['file_description']}
</p>
<form method='post'>
<textarea name='write_comment' rows='3' cols='50' style='float:left;'></textarea>
<input type='hidden' name='file_id' value='{$row['file_id']}' />
<input type='submit' name='post_comment' value='Comment' style='height:40px; float:left;'>
</form>
</div>";
}
}
}
?>