<?php

session_start();

include("../URLs.php");

$postingID = $_GET['postingID'];

$senderID = $_SESSION['userID'];

include("../Db.php");

include("Sanitize.php");            

$postingID = Sanitize::clean($postingID);

$message = $_POST['message'];

$message = Sanitize::cleanDescription($message);



$postingInfoResource = mysql_query("SELECT * FROM Postings WHERE id='$postingID' LIMIT 1");

$postingInfoObj = mysql_fetch_object($postingInfoResource);

$postingName = $postingInfoObj->name;   

if (isset($_GET['recID'])) {

    $recipientID = Sanitize::cleanDescription($_GET['recID']);

} else {

$recipientID = $postingInfoObj->userID;          

}

mysql_query("INSERT INTO Messages SET message='$message', postingID='$postingID', recipientID='$recipientID', senderID='$senderID'");



$recipientInfoResource = mysql_query("SELECT * FROM Users WHERE id='$recipientID'");

$recipientInfoObj = mysql_fetch_object($recipientInfoResource);

$recipientName = $recipientInfoObj->firstName;   

$recipientEmail = $recipientInfoObj->email; 

$mainURL = DOMAIN;



$emailMessage = "



        Hello $recipientName, 

        

        You have received a new message regarding: $postingName

        

        $mainURL

        

        Please login to view your messages. 

        

        Thank you



";



mail($recipientEmail, $postingName, $emailMessage);

header("Location: " . MYACCOUNT);

exit();



?>