If user not banned, user can comment here. So I have a php function to check banned user. In case of comment form submitting, a ajax call 1st check this user is banned or not. If not: comment will be submit else display a massage.
Here, I cannot submit any comment if banned or not, Page refresh if I try to submit. In cannot also understand how to apply my banneduser() response to check form submitting.
php function: (I dont want change it, because I used it many more case)
//user name banned by user
function Banned($user){
global $db;
if(!get_magic_quotes_gpc()){
$touser = addslashes($user);
}
$byuser = $_SESSION['user'];
$result = mysqli_query($db,"SELECT * FROM blocking WHERE byname = '$byuser' AND toname = '$touser'") or die(mysqli_error($db));
return (mysqli_num_rows($result) > 0);
}
Ajax:
// check banned user
function banneduser(){
var Bauthor = $("#author").attr("value");
$.ajax({
type: "POST",
url: "../common",
data: "action=Banned&user="+ Bauthor,
success: function(data){
// How to play with this data
if(data){
return false;
}
}
});
return false;
}
//comment submit if user not banned
$(".reply").on("click",function(){
if(banneduser()){
// make form submission
} else { // You are banned}
});
The AJAX request is asynchronous which means the rest of the code (i.e. the return false will execute before the response is processed. This means that banneduser() will always return false.
What you should do is pass a callback function to banneduser which is then executed once the AJAX response is received:
function banneduser(callback){
var Bauthor = $("#author").attr("value");
$.ajax({
type: "POST",
url: "../common",
data: "action=Banned&user="+ Bauthor,
success: function(data){
callback(data)
}
});
return false;
}
//comment submit if user not banned
$(".reply").on("click",function()
{
banneduser(function (is_banned)
{
if (is_banned)
{
// You are banned
}
else
{
// Submit form
}
}
)
});
Although, this script is easily hacked. It's trivial for a visitor (who know what he's doing) to change the value of #author until he finds a value that works. You should use a purely server-side solution to the problem (i.e. a session variable which stores the author value).