Points System PHP, MYSQL

Can you help me with Point System l already added 'points' in the 'user' database. What else give me a code and where l should put it?

Existance alludes

Just add mysql_query("UPDATE users SET points=points+3 WHERE username='".$_COOKIE['username']."'"); in the insert file.

...

I tried that on Zen. Hadn't worked for me. Maybe another time.

Buoyancy: what goes down, must come up..

My site has seperate files for inserting.

...

Drago, After what code though?

Creator of Unknown

Maleck made a points blog check it out.

...

Where does it go?

Existance alludes

points is just like a profile if you can do that then this should be a walk in the park :P

All you do is put the script in the insert.php file and then include it in a status posting or blog posting ect.

I'm firemade1234

Also it uses cookies. You should switch to sessions. Cookies alast longer but sessions are well-known

I'm firemade1234

Hmm..
Sample script and you guys make it so hard -__-

A true developer

The distinguished MARIOman55 spake:

guys its so simple...
"points inserter page"

$points_given=$_GET["pts"];
$points=mysql_query("SELECT * FROM (table) WHERE (username)='(users username)'");
$record=mysql_fetch_array($points);
$points2add=$record["pts"]+$points_given;
$apply=mysql_query("UPDATE (table) SET pts='".$points2add."' WHERE (username)='(username)'");

walla there. easy peasy.

Mysql_* is deprecated. Use either mysqli or PDO. Also you didn't filter out the $points_given varible so you're open for SQLi

The distinguished MARIOman55 spake:

nah i can still use it and i have the latest version of php.

NO ONE IS GOING TO HACK YOU UNLESS YOU PUT UP A OPEN file UPLOADER.

Ever heard of SQLi... Yeah plus MYSQLi and PDO are more secure now.

The distinguished MARIOman55 spake:

Ehh I don't want to redo my ENTIRE website

You don't need to. Just redo all the insert scripts and select script. I did that one day took a little bit but worth it in the long run

The distinguished MARIOman55 spake:

well i guess ur right, using mysqli helped me with my games update script

lol Hope you're using prepare statements

The distinguished GuitarBoy spake:

<?
$points=$_GET['points'];
if(is_int($points)){
mysqli_query($CONNECTION,"UPDATE `users` SET `points`=`points`+$points WHERE `username`='Ricky'");
mysqli_close($CONNECTION);
}
?>

That's pretty good.

Eh. It's better to have the points script be a variable than GET since someone could just find the file and set the value for it. Unless you have some check before hand.

The distinguished MARIOman55 spake:

... It's just an example

Yes but you know. Then people would thing this is the best way to do it.

The distinguished GuitarBoy spake:

The distinguished lilwayne1556 spake:[quote]The distinguished GuitarBoy spake:<blockquote><?
$points=$_GET['points'];
if(is_int($points)){
mysqli_query($CONNECTION,"UPDATE `users` SET `points`=`points`+$points WHERE `username`='Ricky'");
mysqli_close($CONNECTION);
}
?>

That's pretty good.

Eh. It's better to have the points script be a variable than GET since someone could just find the file and set the value for it. Unless you have some check before hand.</blockquote>

lol $_GET <span style="font-weight:bold;text-shadow:1px 0px 1px #888">IS</span> a variable.

If you're not comfortable with that, then just use $_POST[/quote]

No Not like that... I'm talking about have $points be just that. and then each time they have to set it. Since you're most likely gonna just include this which would make it easier to do and simplier then you should just use like $points = 1; or whatever you want