shop scripts

VZdemon · Post by **VZdemon** » Sat Feb 05, 2011 2:10 pm

hi every1. i'm trying to make a shop script with php and js and i want to make is so that if a player has more then 1 of and item it's amount grows instead of inserting a new item. here are my scripts.
shop.php

Code: Select all

<html>
      <head>
            <script type='text/javascript' src='js\jquery.js'></script>
            <script type='text/javascript'>
                    function get_item()
                    {
                    for (var i=0; i < document.shop.item.length; i++)
                       {
                       if (document.shop.item[i].checked)
                          {
                          var rad_val = document.shop.item[i].value;
                          $.post('buy.php', { name: shop.name.value, item: rad_val,  },
                            function(output) {
                               $('#out').html(output).show();
                            });
                          }
                       }
                    }
            </script>
      </head>
      <body>
      <p>
        <div id='out'>
            <?php
            include "connect.php";
            include "authenticate.php";
            
            $player =  $_SESSION['name'];
            $get = "SELECT * FROM shop";
            $query = mysql_query($get) or die(mysql_error());
            $rows = mysql_num_rows($query) or die(mysql_error());
            echo "<h3>Shop</h3>";
            
            for($i=0;$i<$rows;$i++)
            {
                $row = mysql_fetch_row($query);
                $name = $row[1];
                $type = $row[6];
                $stat = $row[4];
                $price = $row[2];
                $add = $row[3];
                $desc = $row[5];
                
                echo "<form name='shop'>
                     <b>$name</b>
                     <br/>$desc<br/>
                     <i>Price: $price, Type: $type</i>
                     <input type='checkbox' name='item' value='$name'>
                     <p/>";
            }
            echo "<input type='button' value='Purchase' onClick='get_item();'>
                 <input type='hidden' name='name' value='$player'>
                 </form>";
            ?>
        </div>
      </p>
      <a href='main.php'>Back</a>
      </body>
</html>

buy.php

Code: Select all

<?php
include "connect.php";

$player = $_POST['name'];
$item = $_POST['item'];

$get = "SELECT * FROM shop WHERE name='$item'";
$query = mysql_query($get)or die(mysql_error());
$array = mysql_fetch_array($query)or die(mysql_error());

$get2 = "SELECT * FROM inventory WHERE owner='$player'";
$query2 = mysql_query($get2)or die(mysql_error());
$array2 = mysql_fetch_array($query2)or die(mysql_error());

$get3 = "SELECT * FROM players WHERE name='$player'";
$query3 = mysql_query($get3)or die(mysql_error());
$array3 = mysql_fetch_array($query3)or die(mysql_error());

$gold = $array3['gold'];
$amont = $array2['ammount'];
$stat = $array['stat'];
$add = $array['statadd'];
$randid = rand(9999999999,0);
$type = $array['type'];
$price = $array['price'];
$new_amont = $amont + 1;
$new_gold = $gold - $price;

if($player!=null){
  if($item!=null){
    if($gold>0){
      if($gold>$price){
        if($amont<1){
           mysql_query("UPDATE players SET gold='$new_gold' WHERE name='$player'")or die(mysql_error());
           mysql_query("INSERT INTO inventory (name, stats, statadd, randid, type, owner, ammount) VALUES('$item', '$stat', '$add', '$randid', '$type', '$player', '$new_amont')")or die(mysql_error());
           echo "Item $item was succssefully purchased";
         }else{
            mysql_query("UPDATE players SET gold='$new_gold' WHERE name='$player'");
            mysql_query("UPDATE inventory SET ammount='$new_ammount'")or die(mysql_error());
            echo "Item $item was succssefully purchased";
         }
      }else{
         die("You do not have enough gold to purchase this item(s)");
      }
    }else{
       die("You do not have enough gold to purchase this item(s)");
    }
  }else{
     die("<big>Unable to get the item's id.</big>");
  }
}else{
   die("<big>You must <a href='login.php'>login</a> to buy stuff</big>");
}

$get = "SELECT * FROM shop";
$query = mysql_query($get) or die(mysql_error());
$rows = mysql_num_rows($query) or die(mysql_error());
echo "<h3>Shop</h3>";
            
for($i=0;$i<$rows;$i++)
{ 
     $row = mysql_fetch_row($query);
     $name = $row[1];
     $type = $row[6];
     $stat = $row[4];
     $price = $row[2];
     $add = $row[3];
     $desc = $row[5];
                
     echo "<form name='shop'>
           <b>$name</b>
           <br/>$desc<br/>
           <i>Price: $price, Type: $type</i>
           <input type='checkbox' name='item' value='$name'>
           <p/>";
}
echo "<input type='button' value='Purchase' onClick='get_item();'>
      <input type='hidden' name='name' value='player'>
      </form>";
?>

Xaleph · Post by **Xaleph** » Mon Feb 07, 2011 3:53 am

Hmm, maybe the best thing to so is safely execute queries? because i stopped reading the .php file at line 5:

$get = "SELECT * FROM shop WHERE name='$item'";

$item is a simple $_POST[], so if i decided to post ["bladie" OR 1 = 1] i would have had a succesfull query. I now have complete access to all shop rows in your table. Maybe fix that before anything else?

VZdemon · Post by **VZdemon** » Mon Feb 07, 2011 4:48 pm

i fixed it and a couple of other errors but the problem is that if i want to update the ammount where the owner='$player' and where the name='$item'
i gotta have that item in the table so it could also select the name. but if it's the 1st time you bought it then the item's name is not in your database and so it could not execute the query.

what i'm trying to say is that i need a system that checks if you have already bought it and if you did then just add to the ammount instead of inserting a new.

thanks for taking the time to read by the way.

shop scripts

shop scripts

Re: shop scripts

Re: shop scripts