如何仅显示发布评论的用户的删除和编辑链接？

Question

How can I show the delete and edit link to the user who has posted the comment? Just like in Facebook only the person who has posted the comment is allowed to edit or delete the comment. Below are my "show comments", "show delete" and "edit comment" PHP files:

<?php
    include_once("includes/settings.php");
    connect();
    $result=mysql_query("SELECT * FROM comments ORDER BY id DESC");
    echo "<table width='80%' border=0>";
    echo "<tr bgcolor='#CCCCCC'>";
    echo "<td>Name</td>";
    echo "<td>Comments</td>";;
    echo "</tr>";

    while($res=mysql_fetch_array($result)){
        echo "<tr>";
        echo "<td>".$res['Name']."</td>";
        echo "<td>".$res['Comments']."</td>"; 
        echo "<td><a href=\"edit_comment.php?id=$res[id]\">Edit</a> | <a href=\"includes/delete.php?id=$res[id]\">Delete</a></td>";
    }
    echo "</table>";
?>

Below is edit.php

<?php
    error_reporting(0);
    include_once("settings.php");
    connect();
    if(isset($_POST['submit'])) {
        $id = $_POST['id'];
        $Comments=$_POST['Comments'];
        if(empty($Comments)) {
            echo "<font color='red'>Comments field is empty.</font><br/>";
        }
        else {  
            $result=mysql_query("UPDATE comments SET Comments='$Comments' WHERE id=$id");
            echo "Your comments has been edited you will be redirected to the members area page automatically or <a href='../index_ma.php'>click here to go back</a>";
            header('refresh: 3; url=../index_ma.php');
        }
    }
?>
<?php
    $id = $_GET['id'];
    $result=mysql_query("select * from comments where id='$id'");
    while($res=mysql_fetch_array($result))
    {
        $Comments = $res['Comments'];
    }
?>

Below is delete.php

<?php
    include_once("settings.php");
    connect();
    $id = $_GET['id'];
    $result=mysql_query("DELETE FROM comments where id=$id");
    echo "Your comments has been deleted you will be redirected to the members area page automatically or <a href='../index_ma.php'>click here to go back</a>";
    header('refresh: 3; url=../index_ma.php');
?>

Answer 1

This depends on your database schema. I am assuming you have a column that stores the user id. With that, you would so something like this:

if ($CurrentUserId == $res['CommentatorId']) {
  echo "<td><a href=\"edit_comment.php?id=$res[id]\">Edit</a> | <a href=\"includes/delete.php?id=$res[id]\">Delete</a></td>";
}
else {
  echo "<td></td>";
}

You would use the above block instead of your echo "<td><a href=... line in the first code block.

This is how your block would look:

<?php
    include_once("includes/settings.php");
    connect();
    $result=mysql_query("SELECT * FROM comments ORDER BY id DESC");
    echo "<table width='80%' border=0>";
    echo "<tr bgcolor='#CCCCCC'>";
    echo "<td>Name</td>";
    echo "<td>Comments</td>";;
    echo "</tr>";

    while($res=mysql_fetch_array($result)){
        echo "<tr>";
        echo "<td>".$res['Name']."</td>";
        echo "<td>".$res['Comments']."</td>"; 
        if ($CurrentUserId == $res['CommentatorId']) {
            echo "<td><a href=\"edit_comment.php?id=$res[id]\">Edit</a> | <a href=\"includes/delete.php?id=$res[id]\">Delete</a></td>";
        }
        else {
            echo "<td></td>";
        }
    }
    echo "</table>";
?>

Answer 2

I'm not sure if you do so but in your comments table you need to save the id of the user who posted the comment, then in edit.php you need to check if the id of the user logged in is equal to the id of the person trying to edit the comment If yes, then edit, if not then don't allow him to edit it.

In the following code I will suppose that you save the id of the user in the comments table as user_id

$comment_id = intval($_GET['id']);
$result = mysql_query("SELECT user_id FROM Comments WHERE id = $comment_id");
$row = mysql_fetch_array($result);
if($row['user_id'] == $user_id) {
  // Edit the comment
} else {
  // Not permitted to edit the comment
}

I also noticed that you are still using mysql which got deprecated so I suggest you start using mysqli, I also noticed that you are not sanitizing your variables which is very wrong and could cause your database to be injected. Also, in edit.php you sent the id in a link so that is $_GET not $_POST as I edited in my code.

Answer 3

This functionality is applicable only if there is users and login system on your application. If we suppose that the field Name in your comments table is unique and assign the user name (from users table of course) that had wrote the comment, so during a successful login, you have to set this Name value in a session variable, then during printing out the comments you check for this session value and the Name value of the comment to print out the edit and delete links.

Notice: This answer is an algorithm of implementation.