chamilo / chamilo-lms

                Database::query($sql);

            }

            if ($has_attachment) {

                $courseDir = $_course['path'].'/upload/blog';

                $sys_course_path = api_get_path(SYS_COURSE_PATH);

                $updir = $sys_course_path.$courseDir;

                // Try to add an extension to the file if it hasn't one

                $new_file_name = add_ext_on_mime(

                    stripslashes($_FILES['user_upload']['name']),

                    $_FILES['user_upload']['type']

                );

                // user's file name

                $file_name = $_FILES['user_upload']['name'];

                if (!filter_extension($new_file_name)) {

                    echo Display::return_message(get_lang('UplUnableToSaveFileFilteredExtension'), 'error');

                } else {

                    $new_file_name = uniqid('');

                    $new_path = $updir.'/'.$new_file_name;

                    $result = @move_uploaded_file($_FILES['user_upload']['tmp_name'], $new_path);

                    $comment = Database::escape_string($file_comment);

                    $file_name = Database::escape_string($file_name);

                    $size = intval($_FILES['user_upload']['size']);

                    // Storing the attachments if any

                    if ($result) {

                        $sql = "INSERT INTO $blog_table_attachment (c_id, filename,comment, path, post_id,size, blog_id,comment_id)

                            VALUES ($course_id, '$file_name', '$comment', '$new_file_name', $last_post_id, $size, $blog_id, 0)";

                        Database::query($sql);

                        $id = Database::insert_id();

                        if ($id) {

                            $sql = "UPDATE $blog_table_attachment SET id = iid WHERE iid = $id";

                            Database::query($sql);

                        }

                    }

                }

            }

            return $last_post_id;

        } else {

                $sql = "UPDATE $tbl_blogs_comments SET comment_id = iid WHERE iid = $last_id";

                Database::query($sql);

                if ($has_attachment) {

                    $courseDir = $_course['path'] . '/upload/blog';

                    $sys_course_path = api_get_path(SYS_COURSE_PATH);

                    $updir = $sys_course_path . $courseDir;

                    // Try to add an extension to the file if it hasn't one

                    $new_file_name = add_ext_on_mime(

                        stripslashes($_FILES['user_upload']['name']),

                        $_FILES['user_upload']['type']

                    );

                    // user's file name

                    $file_name = Database::escape_string($_FILES['user_upload']['name']);

                    if (!filter_extension($new_file_name)) {

                        echo Display::return_message(get_lang('UplUnableToSaveFileFilteredExtension'), 'error');

                    } else {

                        $new_file_name = uniqid('');

                        $new_path = $updir . '/' . $new_file_name;

                        $result = @move_uploaded_file($_FILES['user_upload']['tmp_name'], $new_path);

                        $comment = Database::escape_string($file_comment);

                        $size = intval($_FILES['user_upload']['size']);

                        // Storing the attachments if any

                        if ($result) {

                            $sql = "INSERT INTO $blog_table_attachment (c_id, filename,comment, path, post_id,size,blog_id,comment_id)

                                VALUES ($course_id, '$file_name', '$comment', '$new_file_name', $post_id, $size, $blog_id, $last_id)";

                            Database::query($sql);

                            $id = Database::insert_id();

                            if ($id) {

                                $sql = "UPDATE $blog_table_attachment SET id = iid WHERE iid = $id";

                                Database::query($sql);

                            }

                        }

                    }

                }

            }

        }

    }