PHP Form - Help Please! Urgent!

echoindia756

Hi there,

I'm build an online game website, and i'm having a bit of trouble getting something to work right. It's a PHP form.

Basically, the idea is that a user can buy "credits" which allows them to make them stronger and better than other players.

The problem I'm having is that when a user buys credits, it not only gives that user credits, but it also gives every other user in the database the same amount of credits.

So if one user buys 100 credits, all users get 100 credits.
So I tried using the WHERE clause, but didn't get anywhere with it.

So I thought of another idea, using a form which asked the user to type in their username and that would add 100 credits to that username.
Here is the code i'm working with:

<form action="called.php" method="post">
Username<input type="text" name="usernamecalled" />
<input type="submit" value="Add Credits!" /> 
</form>

<?php

mysql_query("UPDATE `game_planets.belcredits` SET `game_planets.belcredits` = `game_planets.belcredits`+'100' WHERE `game_users.username` = 'usernamecalled'"); 

?>

I can't seem to get the form to work right, can anyone point me in the right direction? Many thanks!

leatherback

hm.. If you already built a complete gaming site, this should be easy peasy for ya.

In your query, you use usernamecalled, instead of $usernamecalled.

I assume you have some way to sanitize your code to go from:
$_POST['usernamecalled'] to $usernamecalled

echoindia756

Ok, I'm sanitizing $_POST['usernamecalled'] by doing this:

$_POST['usernamecalled'] = '$usernamecalled'

and then the query follows. I changed 'usernamecalled' to $usernamecalled and it's still not working.

Am I doing everything right?

EDIT:

Ok, I just put this code in after the first <?php tag:

ini_set ("display_errors", "1"); 
error_reporting(E_ALL);

This is the error that showed up:

Notice: Undefined variable: usernamecalled in /public_html/called.php on line 77

How do I fix that? Thanks!

rblake81

You are assigning the variable the wrong way round.

To sanitize it should be:

$usernamecalled = $_POST['usernamecalled'];

You can then use $usernamecalled in the query.

leatherback

rblake81 wrote:
You are assigning the variable the wrong way round.

To sanitize it should be:

$usernamecalled = $_POST['usernamecalled'];

You can then use $usernamecalled in the query.

actually, this is not sanitizing, but just copying.
You need to run the variables through some functions to clean it before using it in a database query. A start would be using [man]mysql_real_escape_string[/man]

echoindia756

I've tried putting the form action to this page:

<?php

ini_set ("display_errors", "1"); 
error_reporting(E_ALL); 




$username = htmlspecialchars($_POST['usernamecalled']) or die
            ('Error cannot retrieve information');

		mysql_real_escape_string("$_POST['usernamecalled'],'$username'") or die
		('Error real escape string');


mysql_query("UPDATE `belcredits` FROM 'game_planets' SET `belcredits` FROM 'game_planets' = `belcredits` FROM 'game_planets'+'100' WHERE `username` FROM 'game_users' = '$username'") or die
				('Error updating database');

?>

I'm having some trouble getting the real escape string to work, but when I didn't include that I was getting the last error on submit (Error updating database). I'm not good at this stuff yet..still learning.
Please help me! Thanks so far!

leatherback

I hope this gets you going

if(array_key_exists('usernamecalled', $_POST))
  {
  echo 'Form was submitted';

  // Turn special html chars into codes
  $username = htmlspecialchars($_POST['usernamecalled']) or die
            ('Error cannot retrieve information');

  // Encoe the string for the database
  $username = mysql_real_escape_string($username) or die
            ('Error real escape string');

  // run the query, set limit to 1 if there is only one record to update
  $res = mysql_query("UPDATE game planets set belcredits = belcredits + 100 WHERE username = '$username' limit 1") or die('Error updating database'.mysql_error());
  }
else
  {
  echo 'Submit a form please';
  }

echoindia756

Thank you very much - that works perfectly! I appreciate your help.