<?
authorize();

$ID = $_POST['id'];
$UserID = $_POST['userid'];
$Answer = db_string($_POST['edit']);

if (empty($Answer) || !is_number($ID) || $UserID != $LoggedUser['ID']) {
  error(403);
}

$DB->query("
  UPDATE staff_answers
  SET Answer = '$Answer'
  WHERE QuestionID = '$ID'
    AND UserID = '$UserID'");

header("Location: questions.php?action=view_answers&userid=$UserID");
