PHP Error

[mbecerra]

Hi, i'm new to php, and i'm trying to create a universal high score system in php. I have the basic framework done, and now i'm working on getting the installer to work. However when i run the installer file i created i get this error:

Parse error: parse error, unexpected $ in /fpgs/fpgshttpd/myhighscoreboard/install.php on line 29

Heres the code i wrote for the installer:

removed

I can't seem to find the extra $ php is refering to. Can anyone please help me?

[infolock]

look for the line that has ") type=MyISAM;" (it's line 15 in my editor)

you are missing a ' mark.

so this

) type=MyISAM;

should be this

) type=MyISAM';

[mbecerra]

Ok, Thank You, boy i'm such a newb to miss such an obvious error. Now i'm getting a differant error:

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /fpgs/fpgshttpd/myhighscoreboard/install.php on line 21
Install Failed. Please check your mysql setting in config.php and try again.

removed

To me that line look fine. Any suggestions?

[bpat1434]

That's because mySQL isn't returning any rows. You'd be better to change your IF statement to:

if(!$result)
{
    echo 'Install Failed...';
}
else
{
    echo 'Install was successful...';
}

For SELECT, SHOW, DESCRIBE or EXPLAIN statements, mysql_query() returns a resource on success, or FALSE on error.

For other type of SQL statements, UPDATE, DELETE, DROP, etc, mysql_query() returns TRUE on success or FALSE on error.

Your query falls under the "other" type of statement.

~Brett

[mbecerra]

Hi, You guys are so great, i don't know what i would do without you. Anyways i got it partically running. The score display works but when i try using the add score script i get this error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' at line 1

Heres a partial code sniplet

removed

As you can plainly see there is no '1' at line 1. Any ideas?

[bodzan]

So, you have to have an SQL statement made somewhere in your script and it is clearly not that one you have shown us...

The best idea I have on the matter is that if this script gives you an SQL error than the error is made by config.php script because I figure there is a SQL statement somewhere within...

Sure - I could be stupid as well and don't know something I should....

[bpat1434]

Anyways i got it partically running.

As opposed to running on atoms... lol!! j/k.

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' at line 1

That's referring to line 1 of the SQL Query. Once again, paste your query and we'll look at it for you...

~Brett

[mbecerra]

Heres the full code:

removed

Theres nothing wrong with config.php because highscore.php works fine and config.php is included in the same fashion as add.php

[bpat1434]

I'm gonna take a guess and say that "id" is an auto_increment field. If so, remove it from your query and that should solve your problem.

INSERT INTO highscores (game_id, name, score) VALUES ('$game_id', '$name', '$score')

~Brett

[mbecerra]

Yes id is an auto increment field but, nope didn't work. Sorry

[bpat1434]

okay....

Still the same error? Try formatting your query as this:

$query = 'INSERT INTO highscores (game_id, name, score) 
VALUES ('$game_id', '$name', '$score')';

Then report what the error is. My guess is, you need to escape the quotes from your input as it's causing errors...

~Brett

[mbecerra]

Parse error: parse error, unexpected T_VARIABLE in /fpgs/fpgshttpd/myhighscoreboard/add.php on line 36

removed

How do i "escape the quotes from my input"

[bodzan]

 $query = "INSERT INTO highscores (game_id, name, score)
VALUES ('$game_id', '$name', '$score')"; 

[bodzan]

You can use both [man]addslashes()[/man] or [man]mysql_real_eascape_string()[/man]...

[bpat1434]

It is better that you use mysql_real_escape_string() since addslashes() can be finicky, and can mess up your code.

~Brett

[bodzan]

And just to point out that some of the most secure SQL queries are created like this:

$string = htmlspecialchars($_POST['string']);
$string = stripslashes($string);
$string = mysql_real_escape_string($string);

[mbecerra]

Great i got it to work. Now as for Bodzans suggestion can i modify the code as follows:

removed

Would that make it more secure?

[mbecerra]

Um, does anyone know the answer to my question?

[bpat1434]

Well, I see a couple things:

1. Yes it would be more secure... however... I still see you putting in regular strings, rather than escaping them with the mysql_real_escape_string() function (which you really should use).

2. You populate a variable, and then check to see if it's false.... How about you reverse that: check to see if the $_GET variable is empty or not set, and then do your "security" measures

Hope that helps.

~Brett

[mbecerra]

Hows this?

<?php
//get the game id from the query string and see if no game_id was provided
//if none was provided then kill the script and let the user know
If(!$_GET['game_id']){

print "game_id not provided";
exit;

//otherwise assign the game_id to a variable and perform the security checks
}else {

$game_id = $_GET['game_id'];

//remove any html characters from the game id
$game_id = htmlspecialchars($game_id);

//remove any slashes in the game id
$game_id = stripslashes($game_id);
}

//get the name from the query string and see if no name was provided
//if none was provided then kill the script and let the user know
If(!$_GET['name']){

print "name not provided";
exit;

//otherwise assign the game_id to a variable and perform the security checks
}else {

$name = $_GET['name'];

//remove any html characters from the game id
$name = htmlspecialchars($name);

//remove any slashes in the game id
$name = stripslashes($name);
}

//get the score from the query string and see if no score was provided
//if none was provided then kill the script and let the user know
If(!$_GET['score']){

print "score not provided";
exit;

//otherwise assign the game_id to a variable and perform the security checks
}else {

$score = $_GET['score'];

//remove any html characters from the game id
$score = htmlspecialchars($score);

//remove any slashes in the game id
$score = stripslashes($score);
}

//include the file config.php in the script
include("config.php");

//insert the players name and score into the scoreboard with the game id provided
$sql = "INSERT INTO highscores (game_id, name, score) VALUES ('$game_id', '$name', '$score')";

//check to see if it worked
$result = mysql_query($sql, $connection) or die(mysql_error());

//If something went wrong and we need to let the user know his score wasn't submitted
if (!$result) {

print "Could Not Insert Score";

//everything went well so we will let the user know that the score was added
} else {

print "Your score has been added";

}
?>

More secure then my previous one?