Suppose I have a site where users can leave each other comments.
we have user A, user B and user C. also, support user B has blocked user C.
user A leaves user B a comment, code is as follows:
$query = "insert into comments (author_id, profile_id, comment, date_posted) values(?, ?, ?, now())";
That is the query that that does the job. now user C goes to user B's page to leave a comment, but user B has blocked him from leaving comments.
Can't user C just leave a comment for another user, and just craft the request so he changes profile_id of to the user that has him blocked?
How can i prevent this?
I think you need to make another query and a conditional with that result. Create a query to get user B's blacklist $blacklist then check if (!in_array('user C', $blacklist)) { execute insert query }