Need some help auto-PMing a user

[fly]

I had this posted in another thread, but it was off topic from the original post...

All I need to know is what exactly is going on in these SQL queries belowso that I can pass the right stuff to the variables to get the PM to go through.

Thanks for any help.

Originally Posted by flypaper

And I was talking in the Ucash/Ushop forum yesterday and someone mentioned PMing a member after they were 'theifed'. I liked the idea and tried to poke around and see if there was a function to send PMs like creating threads, but couldn't find one.

Hmmm. Looks like there isn't a function to do it, but these DB queries do:

PHP Code:

$DB_site->query("INSERT INTO " . TABLE_PREFIX . "pmtext\n\t(fromuserid, fromusername, title, message, touserarray, iconid, dateline, showsignature, allowsmilie)\nVALUES\n\t($bbuserinfo[userid], '" . addslashes($bbuserinfo['username']) . "', '$title', '$message', '" . addslashes(serialize($tostring)) . "', $iconid, " . TIMENOW . ", $signature, $disablesmilies)"); 


PHP Code:

$DB_site->query("INSERT INTO " . TABLE_PREFIX . "pm (pmtextid, userid, folderid, messageread) VALUES ($pmtextid, $bbuserinfo[userid], -1, 1)"); 


PHP Code:

$DB_site->shutdown_query("UPDATE " . TABLE_PREFIX . "user SET pmtotal=pmtotal+1 WHERE userid=$bbuserinfo[userid]"); 


Can anyone explain how I pass whatever is needed in these queries and/or what the queries are exactly doing?

[fly]

bump? anyone?

[Colin F]

well the queries are pretty much self explanatory. The first one ads the PM to the database. The text, sender, reciever, title, icon, whatever is saved here.
The middle one enters a database row with a little less data. This is probably used when displaying the pm folders overview, as the database query gets a lot less intensive.
The last one ads a pm to the users pm count.

[fly]

Could someone fill in the values for me for a fake PM? I guess the part I really don't understand is the addslashes and serialze stuff in the first query. Yeah I suck at PHP.

LOL

[Marco van Herwaarden]

addslashes()
Should be used around all character data when inserting into the datebase to avoid exploits.

serialize
Used to store and array (or any other var) into a single field keeping the type an attribures. This means that you can later unserialize this single field again into the origianl var.

[fly]

$DB_site->query("INSERT INTO " . TABLE_PREFIX . "pmtext\n\t(fromuserid, fromusername, title, message, touserarray, iconid, dateline, showsignature, allowsmilie)\nVALUES\n\t(1, '" . addslashes(fly) . "', 'test', 'this is a test', '" . addslashes(serialize(1)) . "', 0, " . TIMENOW . ", 0, 1)");

So would that be a valid query for the first one?

edit: I guess not.

Fatal error: Call to a member function on a non-object in /home/prozac/public_html/useless/test2.php on line 12

I suck at this.

[Deaths]

I believe it would, yes.

[fly]

Originally Posted by flypaper

$DB_site->query("INSERT INTO " . TABLE_PREFIX . "pmtext\n\t(fromuserid, fromusername, title, message, touserarray, iconid, dateline, showsignature, allowsmilie)\nVALUES\n\t(1, '" . addslashes(fly) . "', 'test', 'this is a test', '" . addslashes(serialize(1)) . "', 0, " . TIMENOW . ", 0, 1)");

So would that be a valid query for the first one?

edit: I guess not.


I suck at this.

Oops. I forgot I needed all the REQUIRE stuff at the top. HAHAHAHAHA

Now I don't get an error, but cant see the message inserted. =(

[UK Jimbo]

'fraid I don't think that's right. There's a load of logic missing.

The below code is untested but I think shoudl work. There's nothing in the way of email notification or read receipts in there.

James

PHP Code:


$from_userid=1;
$from_username='adam';

$to_userid=2;
$to_username='eve';

$title = 'This is the subject';
$message = 'This is the message body';
$iconid = 0;
$signature=1; // 1 to show sig, 0 to hide it
$disablesmilies=1; // 1 to hide smilies, 0 to show them


// shouldn't need to edit below here


// build touserarray
$tostring=array($to_userid => $to_username);

// store the message
$DB_site->query("INSERT INTO " . TABLE_PREFIX . "pmtext\n\t(fromuserid, fromusername, title, message, touserarray, iconid, dateline, showsignature, allowsmilie)\nVALUES\n\t($from_userid, '" . mysql_escape_string($from_username) . "', '". mysql_escape_string($title) ."', '". mysql_escape_string($message) ."', '" . addslashes(mysql_escape_string($tostring)) . "', $iconid, " . TIMENOW . ", $signature, $disablesmilies)"); 

// get the inserted private message id
$pmtextid = $DB_site->insert_id();

// save in outbox
$DB_site->query("INSERT INTO " . TABLE_PREFIX . "pm (pmtextid, userid, folderid, messageread) VALUES ($pmtextid, $from_id, -1, 1)"); 

// send in receiving user's inbox
$DB_site->query("INSERT INTO " . TABLE_PREFIX . "pm (pmtextid, userid) VALUES ($pmtextid, $to_userid)");

// add to PM sending user's total
$DB_site->shutdown_query("UPDATE " . TABLE_PREFIX . "user SET pmtotal=pmtotal+1 WHERE userid=$from_userid"); 
// add to PM receiving user's total
$DB_site->shutdown_query("UPDATE " . TABLE_PREFIX . "user SET pmtotal=pmtotal+1 WHERE userid=$to_userid"); 


[fly]

Sweet! That was it. Initally I hadn't listed the other queries because I wanted to get the first one right. I really need to figure out how arrays work. LOL

Here was my final code. The only thing you missed was adding to the recipients unread totals, and I wanted a pmpopup...

PHP Code:

$from_userid=1;
$from_username='fly';

$to_userid=1;
$to_username='fly';

$title = 'This is the subject1';
$message = 'This is the message body1';
$iconid = 0;
$signature=1; // 1 to show sig, 0 to hide it
$disablesmilies=1; // 1 to hide smilies, 0 to show them


// shouldn't need to edit below here


// build touserarray
$tostring=array($to_userid => $to_username);

// store the message
$DB_site->query("INSERT INTO " . TABLE_PREFIX . "pmtext\n\t(fromuserid, fromusername, title, message, touserarray, iconid, dateline, showsignature, allowsmilie)\nVALUES\n\t($from_userid, '" . mysql_escape_string($from_username) . "', '". mysql_escape_string($title) ."', '". mysql_escape_string($message) ."', '" . addslashes(mysql_escape_string($tostring)) . "', $iconid, " . TIMENOW . ", $signature, $disablesmilies)");

// get the inserted private message id
$pmtextid = $DB_site->insert_id();

// save in outbox
// $DB_site->query("INSERT INTO " . TABLE_PREFIX . "pm (pmtextid, userid, folderid, messageread) VALUES ($pmtextid, $from_id, -1, 1)");

// send in receiving user's inbox
$DB_site->query("INSERT INTO " . TABLE_PREFIX . "pm (pmtextid, userid) VALUES ($pmtextid, $to_userid)");

// update recipient pm totals (with pm-popup)
// $DB_site->shutdown_query("UPDATE " . TABLE_PREFIX . "user SET pmtotal=pmtotal+1, pmunread=pmunread+1, pmpopup=2 WHERE userid IN(" . implode(', ', $pmpopupSql) . ")");

// add to PM sending user's total
$DB_site->shutdown_query("UPDATE " . TABLE_PREFIX . "user SET pmtotal=pmtotal+1 WHERE userid=$from_userid");

// add to PM receiving user's total (with pm-popup)
$DB_site->shutdown_query("UPDATE " . TABLE_PREFIX . "user SET pmtotal=pmtotal+1, pmunread=pmunread+1, pmpopup=2 WHERE userid=$to_userid");