<?
	@header("Content-type:text/html; charset=utf-8");
	
	include("../include/common.php");
	
	session_start();
	
	//获取传递参数
	
	$username=addslashes($_GET["username"]);
	
	$code1=addslashes($_GET["code1"]);
	
	$content=$_GET["content"];
	
	//echo $username.$content;
	
	//过滤字符,保证安全性
	
	$content=str_replace("<","&lt;",$content);
	
	$content=str_replace(">","&gt;",$content);
	
	$content=str_replace("\n","<br>",$content);
	
	$content=str_replace("\"","&quot;",$content);
	
	$content=str_replace("\'","&quot;",$content);
	
	
	//判断参数合法性
	
	if($content=="" || strlen($content)>2000 || strlen($content)<5)
	{
		//setcookie("content",$content);
		echo("多写点内容但不能超出长度2000个字符");
		exit();
	}
	
	else if($username=="" || strlen($username)<3)
	{
		echo("用户名密码不能为空且不能少于3个字符");
		exit();
	}
	else if($code1=="" || $code1!=$_SESSION["code"])
	{
		//setcookie("content",$content);
		echo("验证码为空或填写错误");
		exit();
	}
	
	
	//获取其他字段值
	$time=gettime(4);
	$ip=getip();
	
	//防止灌水,评论间隔几秒钟
	$jiange=10;
	$sql="select * from feedback where ip='$ip' order by id desc limit 0,1";
	$mysql->query($sql);
	$arr=$mysql->fetcharray();
	if(is_array($arr) && $time-$arr['time']<$jiange)
	{
		echo "评论时间间隔太小了,休息一会";
		exit();
	}
	
	
	//插入数据
	
	$sql="insert into feedback (user,ip,time,feedback) value('$username','$ip','$time','$content')";
	
	$mysql->query($sql);
	
	//header("location:feedback.php");

?>