Post processing script

<?php

//       ____           _                                       _                             _       _
//      |  _ \ ___  ___| |_   _ __  _ __ ___   ___ ___  ___ ___(_)_ __   __ _   ___  ___ _ __(_)_ __ | |_
//      | |_) / _ \/ __| __| | '_ \| '__/ _ \ / __/ _ \/ __/ __| | '_ \ / _` | / __|/ __| '__| | '_ \| __|
//      |  __/ (_) \__ \ |_  | |_) | | | (_) | (_|  __/\__ \__ \ | | | | (_| | \__ \ (__| |  | | |_) | |_
//      |_|   \___/|___/\__| | .__/|_|  \___/ \___\___||___/___/_|_| |_|\__, | |___/\___|_|  |_| .__/ \__|
//                           |_|        by Erik Keresztes               |___/                  |_|
//                                        (fiverr.com/erik_keresztes)

require_once('config.php');

if($_SERVER['REQUEST_METHOD'] == 'POST')
{
    // get captcha response
    $captcharesponse = json_decode(file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=".recaptchaKeys['secret']."&response={$_POST['g-recaptcha-response']}"));

    // if user did not complete captcha
    if($captcharesponse->success === false)
    {
        // redirect to error page
        redirect('../error?m=captcha');
        die();
    }

    // init variables
    $replyTo = 0;
    $fileID = 0;
    $title = '';
    $message = '';

    // sanitize & store user input
    $replyTo = mysqli_real_escape_string($conn, htmlspecialchars($_POST['replyto']));
    $title = mysqli_real_escape_string($conn, htmlspecialchars($_POST['title']));
    $message = mysqli_real_escape_string($conn, htmlspecialchars($_POST['message']));

    // if message is longer than 3 characters or a file was uploaded
    if(strlen($message) > 3 || file_exists($_FILES['uploadedfile']['tmp_name']) || is_uploaded_file($_FILES['uploadedfile']['tmp_name']))
    {
        // if file was uploaded
        if(file_exists($_FILES['uploadedfile']['tmp_name']) || is_uploaded_file($_FILES['uploadedfile']['tmp_name']))
        {
            // process file
            include('processFile.php');
        }

        // get IP of user
        $ip = $_SERVER['REMOTE_ADDR'];

        if($replyTo == 0) // if post is parent
        {
            // insert post in database
            mysqli_query($conn, "INSERT INTO posts (replyToThreadNr, title, message, fileID, ip, id) VALUES (0, '{$title}', '{$message}', {$fileID}, '{$ip}', '')");

            // get thread number from database
            $threadNr = end(mysqli_fetch_array(mysqli_query($conn, "SELECT nr FROM posts WHERE ip = '{$ip}' ORDER BY date DESC LIMIT 1")));

            // generate ID of user based on IP and thread number (this script is for a bulletin board with no authentication)
            $id = strtoupper(substr(md5($ip . $threadNr), 0, 10));

            // insert ID into database
            mysqli_query($conn, "UPDATE posts SET id = '{$id}' WHERE nr = {$threadNr}");
        }
        else // if post is reply
        {
            // generate ID based on IP and the thread user is replying to
            $id = strtoupper(substr(md5($ip . $replyTo), 0, 10));

            // insert post in database
            mysqli_query($conn, "INSERT INTO posts (replyToThreadNr, title, message, fileID, ip, id) VALUES ({$replyTo}, '{$title}', '{$message}', {$fileID}, '{$ip}', '{$id}')");
        }
        // get post number from database
        $postNr = end(mysqli_fetch_array(mysqli_query($conn, "SELECT nr FROM posts WHERE ip = '{$ip}' ORDER BY date DESC LIMIT 1")));
        redirect('../post?nr='.$postNr); // redirect user to the post
    }
    else
    {
        redirect('../error?m=msgshortornoimg');
    }
}

?>