chamilo / chamilo-lms

                Database::query($sql);

            }

            if ($has_attachment) {

                $courseDir = $_course['path'].'/upload/blog';

                $sys_course_path = api_get_path(SYS_COURSE_PATH);

                $updir = $sys_course_path.$courseDir;

                // Try to add an extension to the file if it hasn't one

                $new_file_name = add_ext_on_mime(

                    stripslashes($_FILES['user_upload']['name']),

                    $_FILES['user_upload']['type']

                );

                // user's file name

                $file_name = $_FILES['user_upload']['name'];

                if (!filter_extension($new_file_name)) {

                    Display::display_error_message(get_lang('UplUnableToSaveFileFilteredExtension'));

                } else {

                    $new_file_name = uniqid('');

                    $new_path = $updir.'/'.$new_file_name;

                    $result = @move_uploaded_file($_FILES['user_upload']['tmp_name'], $new_path);

                    $comment = Database::escape_string($file_comment);

                    // Storing the attachments if any

                    if ($result) {

                        $sql = 'INSERT INTO '.$blog_table_attachment.'(c_id, filename,comment, path, post_id,size, blog_id,comment_id) '.

                            "VALUES ($course_id, '".Database::escape_string(

                                $file_name

                            )."', '".$comment."', '".Database::escape_string(

                                $new_file_name

                            )."' , '".$last_post_id."', '".intval(

                                $_FILES['user_upload']['size']

                            )."',  '".$blog_id."', '0' )";

                        Database::query($sql);

                        $id = Database::insert_id();

                        if ($id) {

                Database::query($sql);

            }

            if ($has_attachment) {

                $courseDir = $_course['path'].'/upload/blog';

                $sys_course_path = api_get_path(SYS_COURSE_PATH);

                $updir = $sys_course_path.$courseDir;

                // Try to add an extension to the file if it hasn't one

                $new_file_name = add_ext_on_mime(

                    stripslashes($_FILES['user_upload']['name']),

                    $_FILES['user_upload']['type']

                );

                // user's file name

                $file_name = $_FILES['user_upload']['name'];

                if (!filter_extension($new_file_name)) {

                    Display:: display_error_message(get_lang('UplUnableToSaveFileFilteredExtension'));

                } else {

                    $new_file_name = uniqid('');

                    $new_path = $updir.'/'.$new_file_name;

                    $result = @move_uploaded_file($_FILES['user_upload']['tmp_name'], $new_path);

                    $comment = Database::escape_string($file_comment);

                    // Storing the attachments if any

                    if ($result) {

                        $sql = 'INSERT INTO '.$blog_table_attachment.'(c_id, filename,comment, path, post_id,size,blog_id,comment_id) '.

                            "VALUES ($course_id, '".Database::escape_string(

                                $file_name

                            )."', '".$comment."', '".Database::escape_string(

                                $new_file_name

                            )."' , '".$post_id."', '".$_FILES['user_upload']['size']."',  '".$blog_id."', '".$last_id."'  )";

                        Database::query($sql);

                        $id = Database::insert_id();

                        if ($id) {

                            $sql = "UPDATE $blog_table_attachment SET id = iid WHERE iid = $id";

                            Database::query($sql);

                        }

					}

				}