Watch the code at the end. If you print the sql code you would see if my username is djjjozsi
UPDATE forumuser SET money = '4444' WHERE 'djjjozsi' = 'djjjozsi'
You have sql injectioned yourself. UPDATE table SET admin=1 WHERE 1=1 , means evrywhere set the money...
A better one:
mysql_query("UPDATE forumuser SET money = '$score' WHERE username = '$username'");
if ($username == $username2)
{
mysql_query("UPDATE forumuser SET money = '$score' WHERE '$username2' = '$username'"); ?>
<table> <tr> <?php
echo "Importing money from trivia: ".$score." from name: ".$username." to: ".$username2." old score: ".$score2; ?> </tr>
<?php
}
how to make it better. print the values from the .mbd file, and build UPDATE query based on its username / money fields. If you can identify the user with its username its redundant element to use another loop to find becouse your're usigng the
WHERE username='$username';
condition in MYSQL