Krik;10962510 wrote:The one thing your code doesn't display is how the system determines which user is submitting the data. I see the "$userID" variable but I don't see where it is set So you need to first make sure that the "$userID" is being set correctly as it is very key in getting everything to work.
This was what I was thinking, but I was under the impression that $userID was some kind of universal string (like $GET or something) or was being pulled from somewhere automatically as part of the overall site mechanics (functions.php or _settings.php).
Ok I'm going to try and explain completely (god help us all):
The code you see here is a modified version of a different file (myprofile.php) whereby users submit information (such as 'nickname', 'about me' etc). It's then stored within a table called 'ws_rv_user' under a row assigned to their userID (which I assume is automatically allocated when a user registers).
Everywhere else throughout the site where users submit other information (mygalleries, myvideos etc) the data gets stored under the same userID. So for example, if you were the 9th user to register with the site, your userID will be 9 and within ws_rv_galleries and ws_rv_videos db tables, your pictures/videos are stored under your userID (9).
I'm trying to add my own extension to the site (mytimetrials) using the same system. I'm using virtually the exact same code of myprofile.php, but for some reason the data isn't getting stored. I understand that there isn't an 'INSERT INTO' command in this code, but then there isn't any 'INSERT INTO' command for the original myprofile.php file I edited. I checked the register.php file to see if that was using 'INSERT INTO' to create the initial db table rows and it does:
// insert in db
$md5pwd = md5(stripslashes($pwd1));
$registerdate=time();
$activationkey = createkey(20);
$activationlink='http://'.$hp_url.'/index.php?site=register&key='.$activationkey;
safe_query("INSERT INTO `".PREFIX."user` (`registerdate`, `lastlogin`, `username`, `password`, `nickname`, `email`, `newsletter`, `activated`) VALUES ('$registerdate', '$registerdate', '$username', '$md5pwd', '$nickname', '$mail', '1', '".$activationkey."')");
$insertid = mysql_insert_id();
// insert in user_groups
safe_query("INSERT INTO ".PREFIX."user_groups ( userID ) values('$insertid' )");
So I presume I cant use UPDATE since there is no row created within ws_rv_timetrials for that user yet? but myprofile.php does add data to the table which wasn't 'inserted':
if(isset($_POST['submit'])) {
$nickname = htmlspecialchars(mb_substr(trim($_POST['nickname']), 0, 30));
if(isset($_POST['mail'])) $mail = $_POST['mail'];
else $mail="";
if(isset($_POST['mail_hide'])) $mail_hide = true;
else $mail_hide = false;
$usernamenew = mb_substr(trim($_POST['usernamenew']), 0, 30);
$usertext = $_POST['usertext'];
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$b_day = $_POST['b_day'];
$b_month = $_POST['b_month'];
$b_year = $_POST['b_year'];
$sex = $_POST['sex'];
$flag = $_POST['flag'];
$about = $_POST['messageabout'];
$clantag = $_POST['clantag'];
$clanname = $_POST['clanname'];
$clanhp = $_POST['clanhp'];
$connection = $_POST['connection'];
$cpu = $_POST['cpu'];
$graphiccard = $_POST['graphiccard'];
$mainboard = $_POST['mainboard'];
$ram = $_POST['ram'];
$soundcard = $_POST['soundcard'];
$town = $_POST['town'];
$browser = $_POST['browser'];
$fc = $_POST['fc'];
$fcalt = $_POST['fcalt'];
$gamertag = $_POST['gamertag'];
$joined = $_POST['joined'];
$miinames = $_POST['miinames'];
$os = $_POST['os'];
$psn = $_POST['psn'];
$skype = $_POST['skype'];
$stream = str_replace('http://', '', $_POST['stream']);
$userquote = $_POST['userquote'];
$youtube = str_replace('http://', '', $_POST['youtube']);
$newsletter = $_POST['newsletter'];
$homepage = str_replace('http://', '', $_POST['homepage']);
$pm_mail = $_POST['pm_mail'];
$avatar = $_FILES['avatar'];
$userpic = $_FILES['userpic'];
$language = $_POST['language'];
So I gather once the initial table row is inserted, columns/fields are easier to add, and you cant add fields until a row has been inserted? anyway, I noticed in the galleries.html file this:
<input type="hidden" name="userID" value="'.$userID.'">
And in myvideos.php this:
<input type="hidden" name="uploader" value="'.$userID.'">
So perhaps something like this is what I'm missing to tell the timetrials db table my correct userID (but I still need to insert the row).
mygalleries.php builds its row like this:
if(isset($_POST['saveedit'])) {
include('_mysql.php');
include('_settings.php');
include('_functions.php');
$_language->read_module('gallery');
$galclass = new Gallery;
$ds = mysql_fetch_array(safe_query("SELECT galleryID FROM ".PREFIX."gallery_pictures WHERE picID='".$_POST['picID']."'"));
if((isgalleryadmin($userID) or $galclass->isgalleryowner($ds['galleryID'], $userID)) and $_POST['picID']) {
safe_query("UPDATE ".PREFIX."gallery_pictures SET name='".$_POST['name']."', comment='".$_POST['comment']."', comments='".(int)$_POST['comments']."' WHERE picID='".$_POST['picID']."'");
if(isset($_POST['reset'])) safe_query("UPDATE ".PREFIX."gallery_pictures SET views='0' WHERE picID='".$_POST['picID']."'");
}
else redirect('index.php?site=gallery', $_language->module['no_pic_set']);
redirect('index.php?site=gallery&picID='.$_POST['picID'], '', 0);
}
Again, no INSERT command, and this is one of the original Webspell files.
myvideos.php uses actions:
elseif($_POST["save"]) {
$movscreenshot=$_FILES["movscreenshot"];
$movheadline=$_POST["movheadline"];
$movfile=$_POST["movfile"];
$movdescription=$_POST["movdescription"];
$movcatID=$_POST["movcatID"];
$uploader=$_POST["uploader"];
$embed=$_POST["embed"];
echo'
<h2>'.$_language->module['movies'].'</h2>';
if($movheadline AND ($movfile OR $embed)) {
if(eregi('http://', $movfile)) $movfile=$movfile;
else $movfile='http://'.$movfile;
safe_query("INSERT INTO ".PREFIX."movies (movID, activated, embed, uploader, movheadline, movfile, movdescription, date, movcatID) values('', '".$admin_activation."', '".$embed."', '".$uploader."', '".$movheadline."', '".$movfile."', '".$movdescription."', '".time()."', '".$movcatID."')");
$id=mysql_insert_id();
if($movscreenshot[name]!="") {
$file_ext=strtolower(substr($movscreenshot[name], strrpos($movscreenshot[name], ".")));
if($file_ext==".gif" OR $file_ext==".jpg" OR $file_ext==".png") {
if($movscreenshot[name] != "") {
move_uploaded_file($movscreenshot[tmp_name], $filepath.$movscreenshot[name]);
@chmod($filepath.$movscreenshot[name], 0755);
$file=$id.$file_ext;
rename($filepath.$movscreenshot[name], $filepath.$file);
if(safe_query("UPDATE ".PREFIX."movies SET movscreenshot='".$file."' WHERE movID='".$id."'")) {
redirect("index.php?site=myvideos", "".$_language->module['vid_created'].".", "3");
} else {
redirect("index.php?site=myvideos", "".$_language->module['screen_error'].".", "3");
}
}
} else echo'<b>'.$_language->module['screen_error1'].'</b><br><br><a href="javascript:history.back()">« '.$_language->module['back'].'</a>';
}
redirect("index.php?site=myvideos", "".$_language->module['mov_added']."!", "3");
} else echo'<b>'.$_language->module['form_error'].'</b><br><br><a href="javascript:history.back()">« '.$_language->module['back'].'</a>';
}
(this was an addon and isn't an original Webspell file).
As I said, both of these store data under the same userID allocated to users upon registration.
else {
safe_query("
INSERT INTO `".PREFIX."timetrials` (`LC`, `LC2`)
VALUE ('" . $LC . "', '" . $LC2 . "')
");
}
Thank you my friend.
Sorry for another jungle of code.
