\";\n for (const row of rows.rows) {\n items += `

${\n xss(marked.parse(row.comment))\n }

by ${row.name} ${moment(row.posted).fromNow()}

`;\n }\n items += \"

\";\n return items;\n}\n\nasync function getLink(story: number): Promise {\n var rows = await sqlite.execute(\n \"select title, url, posted, name, hbc_stories.rowid as rowid from hbc_stories, hbc_users where hbc_stories.poster = hbc_users.id and rowid = ? order by posted desc limit 25;\",\n [story],\n );\n var items = \"

\";\n for (const row of rows.rows) {\n items +=\n `

${row.title}via ${row.name} ${\n moment(row.posted).fromNow()\n }

`;\n }\n items += \"

\";\n return items;\n}\n\nasync function showComments(c): Promise {\n const auth = getAuth(c);\n if (!auth?.userId) {\n return template(\"\", `

`);\n }\n const storyid = c.req.param(\"story\");\n return template(\n \"\",\n `\n ${await getLink(storyid)}\n

Comments

\n ${await getComments(storyid)}\n ${await getForm(storyid, auth)}\n `,\n );\n}\n\nasync function getForm(story: number, auth): Promise {\n if (auth?.userId) {\n return ``;\n }\n return \"\";\n}\n\nexport async function insertComment(comment: string, story: number, poster: string) {\n await sqlite.execute({\n sql: `INSERT INTO hbc_comments (poster, comment, story) VALUES (?, ?, ?)`,\n args: [poster, comment, story],\n });\n}\n\nasync function postComment(c): Promise {\n const auth = getAuth(c);\n const story = c.req.param(\"story\");\n if (auth?.userId) {\n const formData = await c.req.formData();\n const comment = escapeHtml(formData.get(\"comment\") as string);\n const poster = auth.userId as string;\n await insertComment(comment, story, poster);\n }\n return `./${story}`;\n}\n\n// Helper function to escape HTML special characters\nfunction escapeHtml(str: string): string {\n return str\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}","deleted","label",[99],"permalink","https://www.val.town/x/flymaster/hardballcity/code/postComment","extension","actionData","errors"]