reply to message: update mysql table where id matches? - php

Question

I have a messaging system on my site that allows users to send and receive messages to each other.
the bit I am working on now is if a user sends another user a message and the user reads this message, they can reply to it.
at the moment my html form is set up with the message content echoing out in the text area, the user can then remove this content from the text area and re type what they want in it.
then as soon as they hit submit this then should go to message_reply.php and this should insert the new message content where the original message id exists and send it back to the user it came from so this means again update message content where the id, user_to_id and user_from_id is matched and it should insert the original subject with a :reply suffix and also update 'read_message' and set the enum value from 1 back to 0 (as in unread).
I'm struggling with this because I'm new to php and mysql. please can someone show me what I need to do.
my mysql table is called 'ptb_messages' and its laid out like so:
id | from_user_id(the person who sent msg) | to_user_id (recipient) | content | date_sent | read_message | deleted_to | deleted_from |
here's my html form:
<form action="message_reply.php?to=<?php echo "$profile_id"; ?>" method="post">
<textarea name="textarea" id="textarea">
<?php echo "{$message['content']}"; ?>
</textarea>
<?php
}
?>
<input type="image" src="assets/img/icons/email_send.png"
width="50" height="34" name="send_button" id="send_button">
</form>
mysql function (message_reply.php)
<?php
//We check if the form has been sent
if(isset($_POST['textarea'])) {
$textarea = $_POST['textarea'];
//We remove slashes depending on the configuration
if(get_magic_quotes_gpc()) {
$textarea = stripslashes($textarea);
}
//We check if all the fields are filled
if($_POST['textarea']!='') {
$sql = "UPDATE ptb_messages SET (id, from_user_id, to_user_id, textarea) VALUES (NULL, '".$_SESSION['user_id']."', '".$message['from_user_id']."', '".$textarea."');";
mysql_query($sql, $connection);
echo "<div class=\"infobox1\">The message has successfully been sent.</div>";
}
}
?>

Answer 1

In your HTML code, the image is not going to submit the form, so nothing will happen when you click it. You need to either add an onclick or use a submit button (you can use CSS to show an image in the submit button):
onclick example:
<form id="need_an_id_here"
action="message_reply.php?to=<?php echo "$profile_id"; ?>"
method="post">
... your textarea
<input type="image" src="assets/img/icons/email_send.png"
width="50" height="34" name="send_button" id="send_button"
onclick="document.getElementById('need_an_id_here').submit();">
</form>
Also, though it is not your immediate question, your code is prone to security issues (SQL injection, XSS...). You should lookup some tutorials on Prepared Statements and apply it in your code.