chamilo / chamilo-lms

                Database::query($sql);

            }

			if ($has_attachment) {

				$courseDir   = $_course['path'].'/upload/blog';

				$sys_course_path = api_get_path(SYS_COURSE_PATH);

				$updir = $sys_course_path.$courseDir;

				// Try to add an extension to the file if it hasn't one

				$new_file_name = add_ext_on_mime(stripslashes($_FILES['user_upload']['name']), $_FILES['user_upload']['type']);

				// user's file name

				$file_name = $_FILES['user_upload']['name'];

				if (!filter_extension($new_file_name)) {

					Display :: display_error_message(get_lang('UplUnableToSaveFileFilteredExtension'));

				} else {

					$new_file_name = uniqid('');

					$new_path = $updir.'/'.$new_file_name;

					$result = @move_uploaded_file($_FILES['user_upload']['tmp_name'], $new_path);

					$comment = Database::escape_string($file_comment);

					// Storing the attachments if any

					if ($result) {

						$sql = 'INSERT INTO '.$blog_table_attachment.'(c_id, filename,comment, path, post_id,size, blog_id,comment_id) '.

							   "VALUES ($course_id, '".Database::escape_string($file_name)."', '".$comment."', '".Database::escape_string($new_file_name)."' , '".$last_post_id."', '".intval($_FILES['user_upload']['size'])."',  '".$blog_id."', '0' )";

						Database::query($sql);

                        $id = Database::insert_id();

                        if ($id) {

                            $sql = "UPDATE $blog_table_attachment SET id = iid WHERE iid = $id";

                            Database::query($sql);

                        }

					}

				}

			}

		} else {

			Display::display_error_message(get_lang('UplNoFileUploaded'));

		}

                Database::query($sql);

            }

			if ($has_attachment) {

				$courseDir   = $_course['path'].'/upload/blog';

				$sys_course_path = api_get_path(SYS_COURSE_PATH);

				$updir = $sys_course_path.$courseDir;

				// Try to add an extension to the file if it hasn't one

				$new_file_name = add_ext_on_mime(

					stripslashes($_FILES['user_upload']['name']),

					$_FILES['user_upload']['type']

				);

				// user's file name

				$file_name =$_FILES['user_upload']['name'];

				if (!filter_extension($new_file_name)) {

					Display :: display_error_message(get_lang('UplUnableToSaveFileFilteredExtension'));

				} else {

					$new_file_name = uniqid('');

					$new_path=$updir.'/'.$new_file_name;

					$result= @move_uploaded_file($_FILES['user_upload']['tmp_name'], $new_path);

					$comment = Database::escape_string($file_comment);

					// Storing the attachments if any

					if ($result) {

						$sql='INSERT INTO '.$blog_table_attachment.'(c_id, filename,comment, path, post_id,size,blog_id,comment_id) '.

							 "VALUES ($course_id, '".Database::escape_string($file_name)."', '".$comment."', '".Database::escape_string($new_file_name)."' , '".$post_id."', '".$_FILES['user_upload']['size']."',  '".$blog_id."', '".$last_id."'  )";

						Database::query($sql);

                        $id = Database::insert_id();

                        if ($id) {

                            $sql = "UPDATE $blog_table_attachment SET id = iid WHERE iid = $id";

                            Database::query($sql);

                        }

					}

				}

			}

		}

	}