Edit File - save-feedback.php

<?php
session_start();
require '../inc/config.php';

if (empty($_SESSION['userID'])) {
  echo "Not logged in"; exit;
}
$userID  = (int)$_SESSION['userID'];
$orderID = (int)($_POST['order_id'] ?? 0);
$itemID  = (int)($_POST['item_id'] ?? 0);
$rq = (int)($_POST['rating_quality'] ?? 0);
$rp = (int)($_POST['rating_price'] ?? 0);
$rv = (int)($_POST['rating_value'] ?? 0);
$sum = mysqli_real_escape_string($con, $_POST['summary'] ?? '');
$rev = mysqli_real_escape_string($con, $_POST['review']  ?? '');
if (!$orderID || !$itemID || !$rq || !$rp || !$rv || !$sum || !$rev) {
  echo "All fields are required"; exit;
}
$res = mysqli_query($con, "SELECT oi.item_status FROM `orders` o JOIN `order_items` oi ON oi.order_id=o.order_id 
WHERE o.order_id={$orderID} AND o.user_id={$userID} AND oi.p_id={$itemID} LIMIT 1");
if (!$res || mysqli_num_rows($res)===0) {
  echo "Invalid order/item"; exit;
}
$row = mysqli_fetch_assoc($res);
if ($row['item_status'] !== 'delivered') {
  echo "Item not delivered"; exit;
}

$x = mysqli_query($con, "SELECT id FROM `product_feedback` WHERE order_id={$orderID} AND item_id={$itemID} AND user_id={$userID} LIMIT 1");
if (mysqli_num_rows($x)) {
  $f = mysqli_fetch_assoc($x);
  mysqli_query($con, "UPDATE `product_feedback` SET rating_quality={$rq}, rating_price  ={$rp}, rating_value  ={$rv}, summary ='{$sum}',
  review ='{$rev}',updated_at =NOW() WHERE id={$f['id']}");
} else {
  mysqli_query($con, "INSERT INTO `product_feedback`(order_id,item_id,user_id,rating_quality,rating_price,rating_value,summary,review,created_at,updated_at)VALUES({$orderID},{$itemID},{$userID},{$rq},{$rp},{$rv},'{$sum}','{$rev}',NOW(),NOW())");
}

echo "OK";
?>

Kembali