What is wrong with this?

[jamesm87]

function validate_creds($fcreds,$username)
{
$sql = "SELECT creds 
		FROM " . USERS_TABLE . " 
		WHERE LOWER(username) = '" . strtolower($username) . "'";
	if ($result = $db->sql_query($sql))
	{
		if ($row = $db->sql_fetchrow($result))
		{
			if ($fcreds > $row['creds'])
			{
				global $creds;
				return array('error' => true, 'error_msg' => $lang['creds']);
				}
			else 
				{
				return;
     }
                                                }
		}
	}
}

What is wrong with this?
$fcreds is amount sent (they want to debit) and $creds is ammount they have.

Thanks! 🙂

[Pig]

First thing I notice is this:
FROM " . USERS_TABLE . "
you are escaping the string, but USERS_TABLE is not a variable or a function. If it is straight text, then it shouldn't be escaped.

[jamesm87]

this is what is used in the PHPbb forums, and it works perfectly.

I did have it as this before i used that.

function validate_creds($fcreds,$username)
{
$sql = "select creds from php_users where username='$username'";
$result3=mysql_query($sql)
	or die ("cant do check!");
$all3= mysql_fetch_array($result3);
extract ($all3);

if ($fcreds>$creds)
	{
	global $creds;
return array('error' => true, 'error_msg' => $lang['creds']);
	}
	else 
	{
return;
	}
}

Perhaps to save confusion I will ask for help with this (which also does the same thing as last one but does not work)

Thanks for ur reply! 🙂

[phantasm]

check with the database set up. you might need the full name (database.table) instead of the short name (table) when making calls. also check to make sure you have an open database connection. if the connection isn't establishing then you cannot query