Could someone help with stats script?

[karlosio]

Hi,

I have a stats script that ive used on a few websites ive done which shows run of the mill stats (Total hits / unique today) however im creating a profile system for a new project and would like to amend it so it shows how many times someones viewed your profile (like what myspace, bebo has etc)

mysql fields i have at the moment
mem_id - a foreign key for the members table (INT)
ip Varchar(20)
date Varchar(10), 00-00-0000
hits INT

hits script


<?php
include("config.php");
// Includes our config file we made
$get = mysql_query("SELECT * FROM `profile_hits` WHERE `ip` = '".$_SERVER['REMOTE_ADDR']."' && `date` = '".date("d-m-Y")."' && 'mem_id' = '".$_GET['profile']."'") or die(mysql_error());
// Selects from the database, if the user has visited today
$count = mysql_num_rows($get);
// Counts the rows found
if($count == 0) {
// If no rows where found:
$select = mysql_query("INSERT INTO `profile_hits` (`ip`, `date`, `hits`,'mem_id') VALUES ('".$_SERVER['REMOTE_ADDR']."', '".date("d-m-Y")."', '1','".$_GET['profile']."')");
// Inserts into the database, there ip and date of visit
} else {
// If they have been:
$hit = @mysql_fetch_object($select);
// selects the data from the database
$hits = $hit['hits'] + 1;
// Adds one onto current hit counter
$select = mysql_query("UPDATE `profile_hits` SET `hits` = '".$hits."' WHERE `ip` = '".$_SERVER['REMOTE_ADDR']."' && `date` = '".date("d-m-Y")."' && 'mem_id' = '".$_GET['profile']."'");
// Updates Database with there new hit count
}
?>


and stats.php


<?php
include("config.php");
// Includes config again
$selecthits = mysql_query("SELECT * FROM `profile_hits` WHERE `date` = '".date("d-m-Y")."' && 'mem_id' = '".$_GET['profile']."' GROUP BY `ip`") or die(mysql_error());
//Selects ip's visited Today
$counthits = mysql_num_rows($selecthits);
// Counts them
$thits = mysql_result(mysql_query("SELECT SUM(`hits`) as total FROM `profile_hits` WHERE `date` = '".date("d-m-Y")."' && 'mem_id' = '".$_GET['profile']."' GROUP BY `date`"), 0, "total");

echo"<p class='hits'>Unique Visitors Today: ".$counthits." - ";
// Echos todays stats

$totaluhits = mysql_result(mysql_query("SELECT COUNT(hits) FROM fils_stats where 'mem_id' = '".$_GET['profile']."'"), 0);
$totalhits = mysql_result(mysql_query("SELECT SUM(hits) as total FROM fils_stats where 'mem_id' = '".$_GET['profile']."'"), 0, "total");
// Counts totals

echo"Total Visitors: ".$totaluhits." </p>";

// Echos totals
?>


ive been trying to use the url param 'profile' via the $_get method so that gets entered into the 'mem_id' field as my links to the profiles are for example profile.php?profile=10 etc

however when i run that i get

Warning: mysql_result() [function.mysql-result]: Unable to jump to row 0 on MySQL result index 116 in /xxxx/xxxx/stats.php on line 8

Unique Visitors Today: 0 -
Warning: mysql_result(): supplied argument is not a valid MySQL result resource in /xxxx/xxxx/stats.php on line 13

Warning: mysql_result(): supplied argument is not a valid MySQL result resource in /xxxx/xxxx/stats.php on line 14
Total Visitors:

how could i amend this so it displays just a persons profile views

[frosty1433]

Hi,
I think your mysql_queries are wrong. I'm not sure, but I think they should be something like:
<?php
include("config.php");
// Includes config again
$selecthits = mysql_query("SELECT * FROM profile_hits WHERE date = '".date("d-m-Y")."' AND mem_id = '".$_GET['profile']."' GROUP BY ip") or die(mysql_error());
//Selects ip's visited Today
$counthits = mysql_num_rows($selecthits);
// Counts them
$thits = mysql_result(mysql_query("SELECT SUM(hits) as total FROM profile_hits WHERE date = '".date("d-m-Y")."' AND mem_id = '".$_GET['profile']."' GROUP BY date"), 0, "total");

echo"<p class='hits'>Unique Visitors Today: ".$counthits." - ";
// Echos todays stats

$totaluhits = mysql_result(mysql_query("SELECT COUNT(hits) FROM fils_stats WHERE mem_id = '".$_GET['profile']."'"), 0);
$totalhits = mysql_result(mysql_query("SELECT SUM(hits) as total FROM fils_stats WHERE mem_id = '".$_GET['profile']."'"), 0, "total");
// Counts totals

echo"Total Visitors: ".$totaluhits." </p>";

// Echos totals
?>

...That should atleast get you a new error to work off.

Also:
<?php
$query = mysql_query("SELECT row FROM table WHERE value='" . $_GET['value'] . "'");
?>

Having a $_GET variable in a mysql_query is a VERY bad idea AFAIK. That is how hackers inject SQL...