Purchasing Store Items [Resolved]

[Epiales]

Okay, I'm finally back at working a bit on the code. I still have much to change over to mysqli, but taking bits and pieces

The problem I have is that there is a randid field in the store table, but that randid number stays the same all the time. So if someone knew the randid number for any item, then they could just type the url and get the item. This kind of makes it hard to have better items in different locations, as they could just get it in any location.

Is there a way to fix this? Here is my code to the store and to the buy_item...

store.php

Code: Select all

<?php
$counter = 0;

 echo "<small>";
      print "<center><br><br>";
      print "<table border='0' width='95%'>";
      print "<tr><td>";
      print "</td>";
      print "<td>";
          
$sql = "SELECT * FROM store WHERE amount > 0 AND location = '$stats_location'";
$user_query = mysqli_query($db_conx, $sql);
$numrows = mysqli_num_rows($user_query);
       
      print "<table cellspacing='5' style='border: 0px solid white; color: lime;' width='99%'>";
      print "<tr align='left'><td><u>Name</u></td><td><u>Stat</u></td><td><u>Stat Add</u></td><td><u>Type</u></td><td><u>Price</u></td><td></td></tr>";

while ($row = mysqli_fetch_array($user_query, MYSQLI_ASSOC)) {

      $counter = 1;
      print "<tr align='left'><td>$row[name]</td><td>$row[stat]</td><td>$row[statadd]</td><td>$row[type]</td><td>$row[price]</td><td><A href='buy_item.php?randid=$row[randid]'><font color='red'>Buy Item</font></td></tr>";

      }

      print "</table>";
      print "</td></tr></table>";
      print "</center>";
      echo "</small>";

      if ($counter == 0)
      {
            echo "<center>There is nothing in the store at this time because we are broke as hell.<br>";
            
            exit;
      }
  
  ?>

buy_item.php

Code: Select all

<?php

$id = $_SESSION['userid'];
$randid=$_GET['randid'];

$sql = "SELECT * FROM store WHERE randid='$randid'";
$user_query = mysqli_query($db_conx, $sql);
$numrows = mysqli_num_rows($user_query);
while ($row = mysqli_fetch_array($user_query, MYSQLI_ASSOC)) {


if ($stats_gold < $row['price'])
{
 echo "You do not have enough Gold for this purchase!";
  echo "<center><a href='index.php'>Go Back</center>";
  exit;
}
}
$id = $_SESSION['userid'];
$randid=$_GET['randid'];

$sql = "SELECT * FROM store WHERE randid='$randid'";
$user_query = mysqli_query($db_conx, $sql);
$numrows = mysqli_num_rows($user_query);
while ($row = mysqli_fetch_array($user_query, MYSQLI_ASSOC)) {


$name = $row['name'];
$stats1 = $row['stat'];
$statadd = $row['statadd'];
$type = $row['type'];
$price = $row['price'];
$randid2 = rand(1000,999999999);


        $sql = "INSERT INTO inventory (id, name, stats, statadd, randid,type) VALUES ('$id','$name','$stats1',$statadd,$randid2,'$type')";
        $query = mysqli_query($db_conx, $sql);


        $sql = "UPDATE stats set gold=gold-'$price' WHERE id = '$_SESSION[userid]'";
        $query = mysqli_query($db_conx, $sql);

echo "<br><br><span id='errormess'><big><center><font color='lime'>     $name Purchased</center><br></span></big></font>";

}
  ?>

[Callan S.]

If the players location is recorded in a value in their database entry, I would check that if an item can only be gotten from location X, then see if they are indeed at location X if they try and buy it. If not, they can't have it.

If the item is randomly available from the location, I would actually store the last item that was made available for purchase in the players DB entry and erase it if they move to a new location.

[alexander19]

You could also add a level check (if the player doesn't have the right level, he cant purchase the item) :

Code: Select all

if ($playerinfo3['level'] < $row['level']) 
echo "Your level is not high enough to purchase this item!";

To hide that randid in the url you could try setting up buttons for each item rather than a link, and have the randid in a hidden input and pass the info through POST method(this can still be changed if the user inspects the page source through Firebug or other program, but with level check and location as Callan mentioned, it should be ok).

Another way(more difficult) would be to make the shops with different slots, and have each slot called slot1_0, slot1_1 etc, and when the user clicks on a slot, the info(only the slot name) will pass through ajax to a php script where it will select the item depending on the slot you clicked, ofcourse you will still need to make the right checks to make sure everything is alright.

[Epiales]

You could also add a level check (if the player doesn't have the right level, he cant purchase the item) :

Code: Select all

if ($playerinfo3['level'] < $row['level']) 
echo "Your level is not high enough to purchase this item!";

To hide that randid in the url you could try setting up buttons for each item rather than a link, and have the randid in a hidden input and pass the info through POST method(this can still be changed if the user inspects the page source through Firebug or other program, but with level check and location as Callan mentioned, it should be ok).

Another way(more difficult) would be to make the shops with different slots, and have each slot called slot1_0, slot1_1 etc, and when the user clicks on a slot, the info(only the slot name) will pass through ajax to a php script where it will select the item depending on the slot you clicked, ofcourse you will still need to make the right checks to make sure everything is alright.

Thanks... Should have been a no brainer, but I didn't think of it LOL! Got it fixed... Thanks. And thanks to the others