Private Message system (reply functionality) - best practices

[play_]

Hi.

 

I am developing a Private Messaging system.

I am not sure how to implement the 'reply' functionality. I see two ways of doing this (also, this is all in ajax):

 

John PMs Jane:

"Hi jane"

 

I would store in MySQL (simplified for simplicity's sake)

messageID (int),

senderID (int),

recipientID (int),

message (varchar)

 

Now Jane sees the message and clicks 'reply', where a textarea appears and she types and sends her reply. Let's say she writes "Hi John". (shown in image attached)

 

Now, because she is replying to a message john sent, i would ideally want to include the original message john sent her ('Hi Jane').

 

What i'm trying to get at: How to show John his original message ("Hi Jane")?

 

---

option 1:

Use jquery to get the text of the div that holds the message(which returns 'hi jane', from the image attached). pass that text via ajax to the php script. prepend the text to the new message jane typed. Use bbcode so i can later parse the original message from replied message.  I do have a code for this:

if( isset($_POST['original') ) {
$message = '[original-pm]' .  $_POST['original'] . '[/original-pm]' . $message;
}

So if the message being sent is a reply to another message, we prepend that another message(original) to the newly typed message.

 

problems with this:

[*]User can use firebug and change the content of the html/original message. then when he hits submit, jquery would grab whatever he wrote.

[*]User could accidentally write the BBcode [orignal-pm] ) on a message (although the odds are low)

 

---

option 2:

Instead of grabbing the original message with javascript, passing it to the php script and prepending it to the new message, just pass the original's message ID. Have a field in the database called 'parentID' and store it there.

 

problems with this:

[*]Again user could use firebug to change the messageID being passed via ajax. So say he changes messageID from 2 to 5. 5 could be another author's message, and thus, the recipient would be able to view the message.

[*]Could be bothersome having such hierarchy on database.

 

So how should i go about doing this

 

 

[attachment deleted by admin]

[play_]

confusing? =(

[mikesta707]

I would go with the parent message hierarchy. Both ways run the risk of users changing the information that was sent.It would also probably be a bit easier to generate any parent messages that go with it.

[mrMarcus]

could you not create a token of sorts to be checked when replying, ensuring that the integrity of the original message is in tact?

 

in the token, you could store the critical information, ie. messageID, userID, parentID, whatever you need to store, and when Jane then replies, the input fields are then checked against this token, and if things are fishy, return to sender.

[play_]

Will try. thanks