CVE-2015-10046: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability has been found in lolfeedback and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The identifier of the patch is 6cf0b5f2228cd8765f734badd37910051000f2b2. It is recommended to apply a patch to fix this issue. The identifier VDB-218353 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-15T10:15Z
Repository: https://github.com/philipblaquiere/lolfeedback
Language: PHP
Files changed: application/controllers/home.php, application/controllers/register.php, application/controllers/review.php, application/controllers/summoner.php, application/libraries/Recent_games.php, application/models/review_model.php, application/views/comments.php, application/views/include/footer.php, application/views/include/header.php, application/views/recent_games.php, application/views/summoner.php, assets/css/custom.css, assets/js/custom.js
Commit date: 2015-01-03 14:05:44 -0500
Commit message: prevent review sql injection, removed uness

Diff: diff --git a/application/controllers/home.php b/application/controllers/home.php
index 4989ba8..4548272 100644
--- a/application/controllers/home.php
+++ b/application/controllers/home.php
@@ -8,8 +8,9 @@ class Home extends MY_Controller
 		$this->load->model('user_model');
 	}
 
 	public function index()
 	{
-		$this->view_wrapper('home');
+		$data['page'] = "home";
+		$this->view_wrapper('home', $data);
 	}
 }
\ No newline at end of file
diff --git a/application/controllers/register.php b/application/controllers/register.php
index 6eb1996..b074032 100644
--- a/application/controllers/register.php
+++ b/application/controllers/register.php
@@ -13,11 +13,12 @@ class Register extends MY_Controller
   }
   
   public function index()
   {
     //Validation on input (requires that all fields exist)
-    $this->view_wrapper('register');
+    $data['page'] = "register";
+    $this->view_wrapper('register', $data);
   }
 
   public function password_match($pw1)
   {
     $pw2 = $this->input->post('password2');
@@ -69,9 +70,10 @@ class Register extends MY_Controller
       //Save user object and get key to send to user email.
       $user['id'] = $_SESSION['player']['id'];
       $user['name'] = $_SESSION['player']['name'];
       $this->user_model->create($user);
       $this->system_message_model->set_message($user['name'] . ', you have successfully linked your League of Legends account! You can now post comments.', MESSAGE_INFO);
-      $this->view_wrapper('home');
+      $data['page'] = "home";
+      $this->view_wrapper('home', $data);
     }  
   }
 }
\ No newline at end of file
diff --git a/application/controllers/review.php b/application/controllers/review.php
index 59d80e0..20ea766 100644
--- a/application/controllers/review.php
+++ b/application/controllers/review.php
@@ -54,6 +54,12 @@ class Review extends MY_Controller
 		{
 			return FALSE;
 		}
 		$this->review_model->comment($comment);
 	}
+
+	public function get($id)
+	{
+		$data['reviews'] = $this->review_model->get($id);
+		$this->load->view('comments', $data);
+	}
 }
\ No newline at end of file
diff --git a/application/controllers/summoner.php b/application/controllers/summoner.php
index 2ca402b..7d8edbd 100644
--- a/application/controllers/summoner.php
+++ b/application/controllers/summoner.php
@@ -44,10 +44,11 @@ class Summoner extends MY_Controller
 				$data['title'] = "Summoner Not Found";
 			}
 			else
 			{
 				$data['title'] = $summoner_name[$id];
+				$data['id'] = $id;
 			}
 			
 			$data['reviews'] = $this->review_model->get($id);
 			if($data['games'] != NULL)
 			{
@@ -58,9 +59,11 @@ class Summoner extends MY_Controller
 			$stats = $this->review_model->statistics($id);
 
 			$data['stats'] = array_slice($stats, 0, 4);
 			$data['review_stats'] = array_slice($stats, 4, 2);
 			$data['sub_title'] = "Look below for game reviews";
+			$data['summonerid'] = $id;
+			$data['page'] = "summoner";
 		}
 		$this->view_wrapper('summoner', $data);
 	}
 }
\ No newline at end of file
diff --git a/application/libraries/Recent_games.php b/application/libraries/Recent_games.php
index 7e962bc..c9059ce 100644
--- a/application/libraries/Recent_games.php
+++ b/application/libraries/Recent_games.php
@@ -95,11 +95,11 @@ class Recent_games
     {
         $playerids = array();
         array_push($playerids, $id);
         for ($i=0; $i < self::NUM_GAMES_RETURN; $i++)
         {
-            if(array_key_exists($i, $games[self::LOL_GAMES]))
+            if($games != null && array_key_exists($i, $games[self::LOL_GAMES]))
             {
                 $game = $games[self::LOL_GAMES][$i];
                 foreach ($game[self::LOL_PLAYERS] as $player)
                 {
                     array_push($playerids, $player[self::LOL_SUMMONERID]);
diff --git a/application/models/review_model.php b/application/models/review_model.php
index 1c90cbd..42e9882 100644
--- a/application/models/review_model.php
+++ b/application/models/review_model.php
@@ -9,35 +9,35 @@ class Review_model extends CI_Model
 	}
 
 	public function create($review)
 	{
 		$sql = "INSERT INTO reviews (id, fromid, from_name, toid, gameid)
-		VALUES ('" . $review['id'] . "','" . $review['fromid'] . "','" . $review['from_name'] . "','" . $review['toid'] . "','" . $review['gameid'] . "')";
+		VALUES (?,?,?,?,?)";
 
-		$this->db1->query($sql);
+		$this->db1->query($sql, array($review['id'], $review['fromid'], $review['from_name'], $review['toid'], $review['gameid']));
 	}
 
 	public function update($review)
 	{
 		$skill = "skill" . $review['skill'];
 		$skill_value = $review['value'];
 		$reviewid = $review['id'];
 		$sql = "UPDATE reviews 
-				SET $skill = '$skill_value'
-				WHERE id = '$reviewid'";
-		$result = $this->db1->query($sql);
+				SET $skill = ?
+				WHERE id = ?";
+		$result = $this->db1->query($sql, array($skill_value, $reviewid));
 		return TRUE;
 	}
 
 	public function comment($comment)
 	{
 		$message = $comment['message'];
 		$reviewid = $comment['id'];
 		$sql = "UPDATE reviews
-				SET message = '$message'
-				WHERE id = '$reviewid'";
-		$result = $this->db1->query($sql);
+				SET message = ?
+				WHERE id = ?";
+		$result = $this->db1->query($sql, array($message, $reviewid));
 		return TRUE;
 	}
 
 	public function recent($gameids)
 	{
@@ -64,18 +64,18 @@ class Review_model extends CI_Model
 		return $reviews;
 	}
 
 	public function get($toid)
 	{
-		$sql = "SELECT * FROM reviews 
-
+		$sql = "SELECT * FROM reviews
 				WHERE toid = '$toid'
 				AND (message IS NOT NULL
 				OR skill1 != 0
 				OR skill2 != 0
 				OR skill3 != 0
-				OR skill4 != 0)";
+				OR skill4 != 0)
+				ORDER BY created DESC";
 		$result = $this->db1->query($sql);
 		return $result->result_array();
 	}
 
 	public function statistics($id)
diff --git a/application/views/comments.php b/application/views/comments.php
new file mode 100644
index 0000000..2ac820b
--- /dev/null
+++ b/application/views/comments.php
@@ -0,0 +1,35 @@
+<div class="row">
+    <div class="reviews-title">
+      <p></p>
+    </div>
+  </div>
+  <div class="row">
+    <div class="col-md-7">
+    <div class="reviews-content">
+      <?php if(empty($reviews)) { ?>
+        <p>No reviews</p>
+        <?php } else { foreach ($reviews as $review) { ?>
+            <div class="review-header">
+              <p>
+                <a href="<?php echo site_url('summoner')."/".$review['fromid'] ?>"><?php echo $review['from_name'] ?></a>:
+                <?php if($review['skill1'] != 0) { ?>
+                Game-sense-<?php echo $review['skill1'] ?>
+                <?php } if($review['skill2'] != 0) { ?>
+                  Helpful-<?php echo $review['skill2'] ?>
+                <?php } if($review['skill3'] != 0) { ?>
+                  Skillful-<?php echo $review['skill4'] ?>
+                <?php } if($review['skill4'] != 0) { ?>
+                  Delivery-<?php echo $review['skill4'] ?>
+                <?php } ?>
+                <?php echo $review['created'] ?>
+              </p>
+            </div>
+            <div class="review-body">
+              <?php if($review['message'] != NULL) { ?>
+              <p><?php echo $review['message']?></p>
+              <?php } ?>
+            </div>
+        <?php } } ?>
+      </div>
+    </div>
+  </div>
\ No newline at end of file
diff --git a/application/views/include/footer.php b/application/views/include/footer.php
index 043af1d..4c3ef26 100644
--- a/application/views/include/footer.php
+++ b/application/views/include/footer.php
@@ -1,8 +1,7 @@
 			<!-- Content-->
-  			</div><!-- Container -->
-  		</div><!-- Wrap -->
+  		</div><!-- Container -->
   		<div class="footer">
 		    <div class="copyright">Copyright &copy; <?php echo strftime('%Y'); ?></div>
 		</div>
 	    <script src="https://code.jquery.com/jquery-1.10.2.min.js"></script>
 
diff --git a/application/views/include/header.php b/application/views/include/header.php
index 51284a8..9ce5d62 100644
--- a/application/views/include/header.php
+++ b/application/views/include/header.php
@@ -26,9 +26,8 @@
   <link href="<?php echo base_url('assets/css/custom.css') ?>" rel="stylesheet" />
   <link href="<?php echo base_url('assets/css/bootstrap-timepicker.css') ?>" rel="stylesheet" />
   <!--<link href="<?php echo base_url('assets/css/fbscript.css') ?>" rel="stylesheet" />-->
 </head>
 
-<body>
-  <div id="wrap">
-  <!-- Content -->
+<body <?php if($page == "summoner") { ?>id="<?php echo $summonerid ?>" <?php } ?> class="<?php echo $page ?>">
+  <!--   -->
   
\ No newline at end of file
diff --git a/application/views/recent_games.php b/application/views/recent_games.php
index 20bb06b..e69de29 100644
--- a/application/views/recent_games.php
+++ b/application/views/recent_games.php
@@ -1,48 +0,0 @@
-<?php if(empty($games)) { ?>
-<span class="open_sans">No matches have been played</span>
-<?php } ?>
-<?php foreach ($games as $game) { ?>
-
-<div class="lol-match row">
-	<div class="col-md-9">
-		<table class="table table-condensed">
-			<th class="col-md-1"/>
-			<th class="col-md-3"></th>
-			<th>Player</th>
-			<?php foreach ($game['100'] as $player) { ?>
-				<tr>
-					<td>
-						<?php if(isset($player['championSprite'])) { ?>
-						<img src="<?php echo $player['championSprite'] ?>" class="img-responsive" alt="Responsive image">
-						<?php } ?>
-					</td>
-					<td >
-						<div class="lol-match-player-name">
-							<strong><?php echo $player['name'] ?></strong>
-						</div>
-					</td>
-				</tr>
-			<?php } ?>
-		</table>
-		<table class="table table-condensed">
-			<th class="col-md-1"/>
-			<th class="col-md-3"></th>
-			<th>Player</th>
-			<?php foreach ($game['200'] as $player) { ?>
-				<tr>
-					<td>
-						<?php if(isset($player['championSprite'])) { ?>
-						<img src="<?php echo $player['championSprite'] ?>" class="img-responsive" alt="Responsive image">
-						<?php } ?>
-					</td>
-					<td >
-						<div class="lol-match-player-name">
-							<strong><?php echo $player['name'] ?></strong>
-						</div>
-					</td>
-				</tr>
-			<?php } ?>
-		</table>
-	</div>
-</div>
-<?php } ?>
\ No newline at end of file
diff --git a/application/views/register_lol.php b/application/views/register_lol.php
deleted file mode 100644
index 1c8d896..0000000
--- a/application/views/register_lol.php
+++ /dev/null
@@ -1,34 +0,0 @@
-<div class="page-header">
-  <h1>Account Registration - League of Legends</h1>
-  <h4><small>To begin linking your League of Legends account to our website, start by entering your League of Legends summoner name. Only one can be linked to an account at any given time. FYI: We'll never ask you for any League of Legends password.</small></h4>
-</div>
-
-<h2>Step 1 : Enter Summoner Name</h3>
-<!-- Ajax Call -> controllers/ajax/authenticate_summoner -->
-<?php echo form_open('',array('class' => 'form-horizontal padded_10', 'id' => 'lolSummonerRegistrationForm')); ?>
-  <div class="form-group">
-    <?php echo form_label('Summoner Name', 'summonername', array('class' => 'col-sm-2 control-label')); ?>
-    <div class="col-sm-10">
-      <div class="input-group">
-        <div class="input-group-btn">
-          <button type="button" class="btn btn-default dropdown-toggle" id="region" data-toggle="dropdown">Region <span class="caret"></span></button>
-          <ul class="dropdown-menu region-list">
-            <li><a href="#">NA</a></li>
-          </ul>
-        </div><!-- /btn-group -->
-        <?php echo form_input(array('name' => 'summonername','id' => 'summonername', 'class' => 'form-control', 'placeholder' => 'Summoner Name')); ?>
-      </div><!-- /input-group -->
-    </div>
-  </div>
-  <div class="form-group">
-    <div class="col-sm-1 col-sm-offset-3">
-      <?php echo form_submit('submit', 'Find', "class='btn btn-default'"); ?>
-    </div>
-    <div class="col-sm-7" id="summoner_validation_error">
-    </div>
-  </div>
-<?php echo form_close(); ?>
-
-<div id="authenticate_runepage_page">
-  <!-- Validation Content -->
-</div>
diff --git a/application/views/search.php b/application/views/search.php
deleted file mode 100644
index 19090c5..0000000
--- a/application/views/search.php
+++ /dev/null
@@ -1,14 +0,0 @@
-<div class="row">
-  <div class="col-md-4"></div>
-  <div class="col-md-4">
-  	<?php echo form_open('search', array('class' => 'form-horizontal', 'id' => 'search_summoner')); ?>
-  		<div class="input-group">
-		      <?php echo form_input(array('name' => 'search', 'class' => 'form-control', 'placeholder' => 'Search Summoner', 'id' => 'search_textbox')); ?>
-        <span class="input-group-btn">
-          <button type="submit" class="btn btn-default">Search</button>
-        </span>
-		  </div>
-	<?php echo form_close(); ?>
-  </div>
-  <div class="col-md-4"></div>
-</div>
diff --git a/application/views/summoner.php b/application/views/summoner.php
index e0d75c5..2f81dbf 100644
--- a/application/views/summoner.php
+++ b/application/views/summoner.php
@@ -41,11 +41,11 @@
 <?php if(empty($games)) { ?>
 <div class="row">
   <div class="col-md-4 col-md-offset-4"><span class="open_sans"></span></div>
 </div>
 <?php } else { ?>
-<div class="summoner-games">
+<div id="sg_<?php echo $id ?>" class="summoner-games">
   <div class="row">
     <div class="col-md-7">
       <div class="panel-group" id="accordion" role="tablist" aria-multiselectable="true">
       <?php foreach ($games as $gameid => $game) { ?>
         <div class="panel panel-default">
@@ -122,44 +122,10 @@
     </div>
   </div>
 </div>
 <?php } ?>
 
-<div class="summoner-reviews">
-  <div class="row">
-    <div class="reviews-title">
-      <p></p>
-    </div>
-  </div>
-  <div class="row">
-    <div class="col-md-7">
-    <div class="reviews-content">
-      <?php if(empty($reviews)) { ?>
-        <p>No reviews left for <?php echo $title ?></p>
-        <?php } else { foreach ($reviews as $review) { ?>
-            <div class="review-header">
-              <p>
-                <a href="<?php echo site_url('summoner')."/".$review['fromid'] ?>"><?php echo $review['from_name'] ?></a>:
-                <?php if($review['skill1'] != 0) { ?>.
-                  Game-sense-<?php echo $review['skill1'] ?>
-                <?php } if($review['skill2'] != 0) { ?>
-                  Helpful-<?php echo $review['skill2'] ?>
-                <?php } if($review['skill3'] != 0) { ?>
-                  Skillful-<?php echo $review['skill4'] ?>
-                <?php } if($review['skill4'] != 0) { ?>
-                  Delivery-<?php echo $review['skill4'] ?>
-                <?php } ?>
-                <?php echo $review['created'] ?>
-              </p>
-            </div>
-            <div class="review-body">
-              <?php if($review['message'] != NULL) { ?>
-              <p><?php echo $review['message']?></p>
-              <?php } ?>
-            </div>
-        <?php } } ?>
-      </div>
-    </div>
-  </div>
+<div id="sr_<?php echo $id ?>" class="summoner-reviews">
+
 </div>
 
 
diff --git a/assets/css/custom.css b/assets/css/custom.css
index cd48f25..c79e606 100644
--- a/assets/css/custom.css
+++ b/assets/css/custom.css
@@ -224,10 +224,14 @@
   padding-top:9px;
   padding-bottom:1px;
 }
 .review-header{
 }
+.review-body{
+  margin-top: -5px;
+  padding-bottom: 5px;
+}
 ul
 {
     list-style-type: none;
 }
 .site-header{
@@ -235,10 +239,11 @@ ul
 }
 .search{
   padding-right: 15px;
   max-width: 400px;
 }
+
 .summoner-games{
 }
 .top-buffer { margin-top:20px; }
 
 .summoner-reviews{
diff --git a/assets/js/custom.js b/assets/js/custom.js
index 373fdad..b942a18 100644
--- a/assets/js/custom.js
+++ b/assets/js/custom.js
@@ -102,21 +102,10 @@ $(".region-list li a").click(function(event) {
     event.preventDefault();
     var selText = $(this).text();
     $(this).parents('.input-group-btn').find('.dropdown-toggle').html(selText + '  <span class="caret"></span> ');
 });
 
-function reloadLoLRegister(message) {
-    alert("in reload");
-    $.ajax({
-        url: '/LoLRep/add_esport/register_LoL',
-        type: "post",
-        data: {},
-        success: function(data){
-            $("#authenticate_runepage_page").html(message);
-        }
-    });
-}
 
 function switchButtonToRegister()
 {
     button = document.getElementById('rune_page_verification_button');
     button.setAttribute('id','create_user');
@@ -305,5 +294,27 @@ $(document).on('change', ".skill-radio", function() {
             return;
         }
     });
 });
 
+$(document).ready(function() {
+    if($('body').is('.summoner')){
+
+        var summonerId = document.getElementsByTagName("body")[0].id
+        $("#sr_"+summonerId).html('<div class="row"><div class="col-md-1 col-md-offset-5"><div class="spinner"><i class="fa-li fa fa-spinner fa-spin fa-2x"></i></div></div></div>');
+
+        $.ajax({
+        url: "/perfect/index.php/review/get/"+summonerId,
+        type: 'POST',
+        data: {},
+        success: function(data){
+            $("#sr_"+summonerId).html();
+            $("#sr_"+summonerId).html(data);
+        },
+        error:function(jqXHR, textStatus, errorThrown){
+            $("#"+buttonId).html('An error has occured creating the review:' + textStatus +errorThrown);
+            return;
+        }
+    });
+  }
+});
+

Vulnerable code: 		$this->view_wrapper('home');
    $this->view_wrapper('register');
      $this->view_wrapper('home');
            if(array_key_exists($i, $games[self::LOL_GAMES]))
		VALUES ('" . $review['id'] . "','" . $review['fromid'] . "','" . $review['from_name'] . "','" . $review['toid'] . "','" . $review['gameid'] . "')";
		$this->db1->query($sql);
				SET $skill = '$skill_value'
				WHERE id = '$reviewid'";
		$result = $this->db1->query($sql);
				SET message = '$message'
				WHERE id = '$reviewid'";
		$result = $this->db1->query($sql);
		$sql = "SELECT * FROM reviews 

				OR skill4 != 0)";
  			</div><!-- Container -->
  		</div><!-- Wrap -->
<body>
  <div id="wrap">
  <!-- Content -->
<?php if(empty($games)) { ?>
<span class="open_sans">No matches have been played</span>
<?php } ?>
<?php foreach ($games as $game) { ?>

<div class="lol-match row">
	<div class="col-md-9">
		<table class="table table-condensed">
			<th class="col-md-1"/>
			<th class="col-md-3"></th>
			<th>Player</th>
			<?php foreach ($game['100'] as $player) { ?>
				<tr>
					<td>
						<?php if(isset($player['championSprite'])) { ?>
						<img src="<?php echo $player['championSprite'] ?>" class="img-responsive" alt="Responsive image">
						<?php } ?>
					</td>
					<td >
						<div class="lol-match-player-name">
							<strong><?php echo $player['name'] ?></strong>
						</div>
					</td>
				</tr>
			<?php } ?>
		</table>
		<table class="table table-condensed">
			<th class="col-md-1"/>
			<th class="col-md-3"></th>
			<th>Player</th>
			<?php foreach ($game['200'] as $player) { ?>
				<tr>
					<td>
						<?php if(isset($player['championSprite'])) { ?>
						<img src="<?php echo $player['championSprite'] ?>" class="img-responsive" alt="Responsive image">
						<?php } ?>
					</td>
					<td >
						<div class="lol-match-player-name">
							<strong><?php echo $player['name'] ?></strong>
						</div>
					</td>
				</tr>
			<?php } ?>
		</table>
	</div>
</div>
<?php } ?>
<div class="page-header">
  <h1>Account Registration - League of Legends</h1>
  <h4><small>To begin linking your League of Legends account to our website, start by entering your League of Legends summoner name. Only one can be linked to an account at any given time. FYI: We'll never ask you for any League of Legends password.</small></h4>
</div>

<h2>Step 1 : Enter Summoner Name</h3>
<!-- Ajax Call -> controllers/ajax/authenticate_summoner -->
<?php echo form_open('',array('class' => 'form-horizontal padded_10', 'id' => 'lolSummonerRegistrationForm')); ?>
  <div class="form-group">
    <?php echo form_label('Summoner Name', 'summonername', array('class' => 'col-sm-2 control-label')); ?>
    <div class="col-sm-10">
      <div class="input-group">
        <div class="input-group-btn">
          <button type="button" class="btn btn-default dropdown-toggle" id="region" data-toggle="dropdown">Region <span class="caret"></span></button>
          <ul class="dropdown-menu region-list">
            <li><a href="#">NA</a></li>
          </ul>
        </div><!-- /btn-group -->
        <?php echo form_input(array('name' => 'summonername','id' => 'summonername', 'class' => 'form-control', 'placeholder' => 'Summoner Name')); ?>
      </div><!-- /input-group -->
    </div>
  </div>
  <div class="form-group">
    <div class="col-sm-1 col-sm-offset-3">
      <?php echo form_submit('submit', 'Find', "class='btn btn-default'"); ?>
    </div>
    <div class="col-sm-7" id="summoner_validation_error">
    </div>
  </div>
<?php echo form_close(); ?>

<div id="authenticate_runepage_page">
  <!-- Validation Content -->
</div>
<div class="row">
  <div class="col-md-4"></div>
  <div class="col-md-4">
  	<?php echo form_open('search', array('class' => 'form-horizontal', 'id' => 'search_summoner')); ?>
  		<div class="input-group">
		      <?php echo form_input(array('name' => 'search', 'class' => 'form-control', 'placeholder' => 'Search Summoner', 'id' => 'search_textbox')); ?>
        <span class="input-group-btn">
          <button type="submit" class="btn btn-default">Search</button>
        </span>
		  </div>
	<?php echo form_close(); ?>
  </div>
  <div class="col-md-4"></div>
</div>
<div class="summoner-games">
<div class="summoner-reviews">
  <div class="row">
    <div class="reviews-title">
      <p></p>
    </div>
  </div>
  <div class="row">
    <div class="col-md-7">
    <div class="reviews-content">
      <?php if(empty($reviews)) { ?>
        <p>No reviews left for <?php echo $title ?></p>
        <?php } else { foreach ($reviews as $review) { ?>
            <div class="review-header">
              <p>
                <a href="<?php echo site_url('summoner')."/".$review['fromid'] ?>"><?php echo $review['from_name'] ?></a>:
                <?php if($review['skill1'] != 0) { ?>.
                  Game-sense-<?php echo $review['skill1'] ?>
                <?php } if($review['skill2'] != 0) { ?>
                  Helpful-<?php echo $review['skill2'] ?>
                <?php } if($review['skill3'] != 0) { ?>
                  Skillful-<?php echo $review['skill4'] ?>
                <?php } if($review['skill4'] != 0) { ?>
                  Delivery-<?php echo $review['skill4'] ?>
                <?php } ?>
                <?php echo $review['created'] ?>
              </p>
            </div>
            <div class="review-body">
              <?php if($review['message'] != NULL) { ?>
              <p><?php echo $review['message']?></p>
              <?php } ?>
            </div>
        <?php } } ?>
      </div>
    </div>
  </div>
function reloadLoLRegister(message) {
    alert("in reload");
    $.ajax({
        url: '/LoLRep/add_esport/register_LoL',
        type: "post",
        data: {},
        success: function(data){
            $("#authenticate_runepage_page").html(message);
        }
    });
}
Fixed code: 		$data['page'] = "home";
		$this->view_wrapper('home', $data);
    $data['page'] = "register";
    $this->view_wrapper('register', $data);
      $data['page'] = "home";
      $this->view_wrapper('home', $data);

	public function get($id)
	{
		$data['reviews'] = $this->review_model->get($id);
		$this->load->view('comments', $data);
	}
				$data['id'] = $id;
			$data['summonerid'] = $id;
			$data['page'] = "summoner";
            if($games != null && array_key_exists($i, $games[self::LOL_GAMES]))
		VALUES (?,?,?,?,?)";
		$this->db1->query($sql, array($review['id'], $review['fromid'], $review['from_name'], $review['toid'], $review['gameid']));
				SET $skill = ?
				WHERE id = ?";
		$result = $this->db1->query($sql, array($skill_value, $reviewid));
				SET message = ?
				WHERE id = ?";
		$result = $this->db1->query($sql, array($message, $reviewid));
		$sql = "SELECT * FROM reviews
				OR skill4 != 0)
				ORDER BY created DESC";
<div class="row">
    <div class="reviews-title">
      <p></p>
    </div>
  </div>
  <div class="row">
    <div class="col-md-7">
    <div class="reviews-content">
      <?php if(empty($reviews)) { ?>
        <p>No reviews</p>
        <?php } else { foreach ($reviews as $review) { ?>
            <div class="review-header">
              <p>
                <a href="<?php echo site_url('summoner')."/".$review['fromid'] ?>"><?php echo $review['from_name'] ?></a>:
                <?php if($review['skill1'] != 0) { ?>
                Game-sense-<?php echo $review['skill1'] ?>
                <?php } if($review['skill2'] != 0) { ?>
                  Helpful-<?php echo $review['skill2'] ?>
                <?php } if($review['skill3'] != 0) { ?>
                  Skillful-<?php echo $review['skill4'] ?>
                <?php } if($review['skill4'] != 0) { ?>
                  Delivery-<?php echo $review['skill4'] ?>
                <?php } ?>
                <?php echo $review['created'] ?>
              </p>
            </div>
            <div class="review-body">
              <?php if($review['message'] != NULL) { ?>
              <p><?php echo $review['message']?></p>
              <?php } ?>
            </div>
        <?php } } ?>
      </div>
    </div>
  </div>
  		</div><!-- Container -->
<body <?php if($page == "summoner") { ?>id="<?php echo $summonerid ?>" <?php } ?> class="<?php echo $page ?>">
  <!--   -->
<div id="sg_<?php echo $id ?>" class="summoner-games">
<div id="sr_<?php echo $id ?>" class="summoner-reviews">

.review-body{
  margin-top: -5px;
  padding-bottom: 5px;
}

$(document).ready(function() {
    if($('body').is('.summoner')){

        var summonerId = document.getElementsByTagName("body")[0].id
        $("#sr_"+summonerId).html('<div class="row"><div class="col-md-1 col-md-offset-5"><div class="spinner"><i class="fa-li fa fa-spinner fa-spin fa-2x"></i></div></div></div>');

        $.ajax({
        url: "/perfect/index.php/review/get/"+summonerId,
        type: 'POST',
        data: {},
        success: function(data){
            $("#sr_"+summonerId).html();
            $("#sr_"+summonerId).html(data);
        },
        error:function(jqXHR, textStatus, errorThrown){
            $("#"+buttonId).html('An error has occured creating the review:' + textStatus +errorThrown);
            return;
        }
    });
  }
});