Creating New or Updating Table

[epic1231]

Hey everyone, I have read over the forums but can't seem to fix my problem

I have setup currently two tables one is called loots the other is loots_log.. loots contains the loots that users can have, their ID number etc.. loots_log stores the userID, loot ID and the amount the user has.

When I setup the ability for them to be purchased I did it this way


if( isset($_POST[bonus1]) ) {

$pirate = Pirate::getById($user);

if( $pirate->favpoint > $_POST[bonusPoint] ) {
$userOwn = user_loot_own( $u, $lid );
if( $userOwn > 0 ) {
query("UPDATE `loots_log` SET `lootAmount`=(`lootAmount`+15) WHERE `userid`=$u AND `lootId`=$lid");
}
else {
query("INSERT INTO `loots_log` (`userid`, `lootId`, `lootAmount`) VALUES ($u, $lid, 15)");
}

$str = '<div class=noticeBox><P class=successP>Success!</P><H2>The Director Gave You 15 Unlocked Phones!</H2></div>';
}
else {
$str = '<div class=noticeBox><P class=failP>Failure!</P><H2>You do not have '.number_format($_POST[bonusPoint],0).' Points!</H2></div>';
}

}


The above gives the user the chance to buy them and will create new in the loots_log if they do not own any currently or will update the log if they currently do own them. (I think)

For some reason though I can't seem to figure out how to transfer the $lid from my form to this so it works.

Form is


echo '<form ACTION="'.$appCanvasUrl.'earn.php" method="POST">';
echo '<input type="hidden" name="bonusPoint" value="10">';
echo '<input type="hidden" name="$lid" value="20"></P>';
echo '<P class=titleP><input type="submit" name="bonus1" value="Accept for 10 Points"></P>';
echo '</form>';


The $lid value for this particular instance I am trying to pass is for loot ID #20 but I get this error

Invalid query -- SELECT COUNT(*) FROM `loots_log` WHERE `userid`= AND `lootId`= -- You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND `lootId`=' at line 1

Any suggestions?

Thanks,
Bill

[abduraooft]

Invalid query -- SELECT COUNT(*) FROM `loots_log` WHERE `userid`= AND `lootId`= -- You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND `lootId`=' at line 1 Where's your code for select query?

[epic1231]

I would assume that is pulling this select query from my include file


//====================================
// Total Loot Own By User
//====================================
function user_loot_own( $u, $lid ) {

$res = query("SELECT COUNT(*) FROM `loots_log` WHERE `userid`=$u AND `lootId`=$lid");
list($total) = mysql_fetch_array($res);

if( $total > 0 ) {
$res = query("SELECT * FROM `loots_log` WHERE `userid`=$u AND `lootId`=$lid");
$row = mysql_fetch_assoc($res);
return $row[lootAmount];
}
else
return 0;

}

[abduraooft]

function user_loot_own( $u, $lid ) Are you collecting data from the $_POST global array? Or just passing the values $u and $lid to the function, assuming register_globals is turned ON? We need to see the calling part of your code too.

[epic1231]

Ok sorry I think your original post helped me figure out what I am doing wrong.. I don't know if I am phrasing this right but when I use this


$userOwn = user_loot_own( $u, $lid );


am I calling the function in another file?

(this one is an include file, i did not want to be calling any other files if that is the case)


//====================================
// Total Loot Own By User
//====================================
function user_loot_own( $u, $lid ) {


-- I couldn't figure out why the Select*Count was showing earlier but soon as you asked for it I realized it was coming from another file, so I am thinking with that I am calling the other file instead of doing the tasks I had setup

[abduraooft]

To call your function like $userOwn = user_loot_own( $u, $lid ); you'd need to ensure that your variables $u and $lid have the expected values in it. Try echoing them before calling like
echo 'u: '.$u.' lid:'.$lid; (not sure about the variable $u)

Most probably you'd need to add a line $lid=$_POST['lid']; before your function call.

[epic1231]

thank you very much for your help!

[abduraooft]

Have you sorted it out? Anyway, your queries are susceptible to sql injection, read www.tizag.com/mysqlTutorial/mysql-php-sql-injection.php