<%
Option Explicit
Response.Expires = -1000
%>
<!--#INCLUDE file="constants.asp" -->
<!--#INCLUDE file="generalfunctions.asp" -->
<%

'======================================================================
' This ASP script en database has been made by Martijn ten Napel
' homepage: http://www.noipo.org
' This script is freeware and you can twist and turn it to your liking.
'======================================================================

dim strMessage
dim objConn
dim strSQL
dim strHomepage
dim strID

strMessage = ""
strHomepage = ""

if request("id") = "" then
	strID = "0"
else
	strID = cstr(request("id"))
end if

'errortrapping
if (cstr(request("id")) = "") or (cstr(request("id")) = "0") then
	response.redirect "errorpage.asp"
end if

'backup errortrapping for the javascript on commenst.asp
if cstr(request("author")) = "" then
	strMessage = ADDNAME
	response.redirect "comment.asp?id=" & server.urlencode(request("id")) & "&message=" & server.urlencode(strMessage)
end if

'backup errortrapping for the javascript on commenst.asp
if cstr(request("comment")) = "" then
	strMessage = ADDCOMMENT
	response.redirect "comment.asp?id=" & server.urlencode(request("id")) & "&message=" & server.urlencode(strMessage)
end if

strHomepage = checkurl(cstr(request("homepage")))

'fill session variables with the content of the input fields
session("author") = RemoveHTML(cstr(request("author")))
session("email") = RemoveHTML(cstr(request("email")))
session("homepage") = RemoveHTML(strHomepage)
session("comment") = RemoveHTML(cstr(request("comment")))

	'save values in db
	
	'open db connection
	Set objConn = Server.CreateObject("ADODB.Connection")
objConn.Open("DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=" & Server.MapPath(LOCATION))

	strSQL = "insert into COMMENTS (refernr, author, email, homepage, comment) values" &_
	 	"('" & cstr(request("id")) & "'," &_
		" '" & session("author") & "'," &_
		" '" & session("email") & "'," &_
		" '" & session("homepage") & "'," &_
		" '" & session("comment") & "');"
	
	objConn.Execute(strSQL)

	'close db connection
	objConn.Close
	Set objConn = Nothing

	'return to the comments page and fill in the thank you message
	session("author") = ""
	session("email") = ""
	session("homepage") = "" 
	session("comment") = ""
	strMessage = THANKYOU
	response.redirect "comment.asp?id=" & server.urlencode(request("id")) & "&message=" & server.urlencode(strMessage)

%>