<?php 

$dir = '../';

require_once $dir.'includes/main.php';

$errors = array();

$id = (int)$_POST['id'];
$add = (int)$_POST['add'];

// check login
if(!isset($user_id)){
   $errors[] = LOG_IN;
}

// check id
$sql = "SELECT * FROM listings WHERE id = '{$id}' LIMIT 1";
if(fetch_rows($sql) < 1){
   $errors[] = "Listing #$id";
   $errors[] = "we could not find any records with this ID";
}else{
   
   $x = fetch_records($sql);

   if($user_id != $x['user_id']){
      $errors[] = "You don't have permission to edit this listing";
   }

}

// check points
if($add < 1){
   $errors[] = "You must enter 1 point or more";
}

if($add > $u['points']){
   $errors[] = "You don't have enough points";
   $errors[] = "Please enter: {$u['points']} or less";
}

// check errors
if(!empty($errors)){

   ex_messages($errors);

}else{

   if(query("UPDATE listings SET points = points + $add WHERE id = '{$id}' LIMIT 1")){

      query("UPDATE users SET points = points - $add WHERE id = '{$user_id}' LIMIT 1");
      
      ex_redirect("listing/$id");

   }else{

      ex_messages([ERROR_DATABASE]);

   }

}

?>