Error, not solved yet, please help :)

EmperiO

<?php
include 'connect.php';
session_start();
if (isset($_SESSION['player'])) 
   {
    if(isset($_POST['submit']))
    {
     $player=$_SESSION['player'];
     $request=$_POST['req'];
     $playerstats1="SELECT * from km_users where playername='$player'";
     $playerstats2=mysql_query($playerstats1) or die ("Could not find player");
     $playerstats3=mysql_fetch_array($playerstats2);
     if ($playerstats3[requestnum]>=3);
     {
           print "You already have 3 requests, go back to<A href='index.php'>your Nation</a>";
     }
     else if($request || strlen($request)>60 || strlen($clan)<10)
          {
             $reclan=$playerstats3[clanname];
             $SQL = "INSERT into km_requests(reqmember, reqclanname, reqmessage) VALUES ('$player', '$reclan', '$request')"; 
             mysql_query($SQL) or die(mysql_error());
             $updateplayerstats="Update km_users set requestnum=requestnum+1 where playername='$player'";
             mysql_query($updateplayerstats) or die(mysql_error());
             print "Your Request have been added,<br> lets hope that your Emperor or one of your members answers quick,<br> for now go back to <A href='index.php'>Your Nation</a>";
           }
      else
        {
    print "Your request is too short/long";
        }
    }
   }
else
   {
    print "You are not logged in, please <A href='login.php'>Login</a>";
   }
?>

This code is keep giving the next error:

Parse error: syntax error, unexpected T_ELSE in D:\htdocs\host\2kgrpg\sendrequest.php on line 17

Can someone tell me whats wrong in this code?
Thanks in future.

laserlight

You have an extra semi-colon on this line:

if ($playerstats3[requestnum]>=3);

EmperiO

laserlight wrote:
You have an extra semi-colon on this line:
if ($playerstats3[requestnum]>=3);

Thanks man i've totaly forgot that!

laserlight

You're welcome 🙂
Remember to mark this thread as resolved (if it is) using the thread tools.

bradmasterx

$player=addslashes($_SESSION['player']);

In firefox you can edit session varibles. so watch out.

laserlight

In firefox you can edit session varibles. so watch out.

What extension allows that? I thought that should be impossible, but I would like to see how it is done first before I decide.

In any case, addslashes() is wrong here. It should be mysql_real_escape_string().

EDIT:
I thought about it some more, and I want to call bradmasterx's bluff. The session data is stored server side, so I really do not see how the client can arbitrarily alter it. Nonetheless, bradmasterx is correct in the sense that you still need to use mysql_real_escape_string() since $_SESSION['player'] contains text that may have say, single quotes (and thus allow SQL injection for a carefully crafted player name).