Kinda glitchy code for spendin "points" to get a template...

[DiscoTrio]

Kk, I dont really have any notation but I used tabs and made my ifs the best I could to simplify it.

By the way im not getting any error messages, just need help getting it to do what I want.

 

<?php
$con = mysql_connect("localhost","********","**********");
if (!$con){die('Could not connect: ' . mysql_error());}
mysql_select_db("bmvybfbk_website", $con);
$result = mysql_query("SELECT * FROM templatesearch ORDER BY id");
while($row = mysql_fetch_array($result))
{
$tid = $row['id'];
$tprice = $row['price'];
echo $row['tname'] . "<br>" . $row['preview'] . "<br>" . "Costs: " . $row['price'] . " points.	 ";
echo "<a href='templatesearch.php?action=buy&temp=$tid'><font face='Papyrus' size='3'> Buy</font></a>";
echo "<br><br>";
	if ($action == buy) 
	{
	$result2 = mysql_query ("SELECT * FROM users WHERE username = '$session->username';");
	while($row = mysql_fetch_array($result2)){
	$totalpoints = $row['points'];}
		if ($totalpoints >= $tprice){
			$result2 = mysql_query ("SELECT * FROM items2 WHERE username = '$session->username';");
			while($row = mysql_fetch_array($result2)){
			$usedid = $row['name2'];
				if ($usedid <> $tid){
				mysql_query ("UPDATE users SET points = points - '$tprice' WHERE CONVERT( `users`.`username` USING utf8 ) = '$session->username' LIMIT 1;");
				mysql_query ("INSERT INTO `items2` (`username`, `name2`, `id2`) VALUES ('$session->username', '$tid', '1');");
				mysql_query ("UPDATE users SET tempid = $tid WHERE username = '$session->username' LIMIT 1;");
				echo"  You bought it!  ";
				?><meta http-equiv="refresh" content="1;url=/$session->username"><?
				}
				else {
				echo "You already own it!";
				?><meta http-equiv="refresh" content="1;url=templateowned.php"><?
				}
			}
		}
	}
}
?>

 

So whats happening here is at the very top of the code its spits out a few templates on the screen each with a buy button that adds ?action=buy&temp=$tid as defined above $tid is the id number of the template in the database.  Also defined (but not used yet) is the price.

 

A bit further down it detects if action == buy then the next three lines grab the value of the users points they have at the moment.

 

The next if statement decides if you have enough points with the >= (heres my first trouble point.  No matter how many points I have it comes out false.)  If that had passed it, the next three lines ask if you already own that template.  What it does is check the table 'items2' if there is already a table in there that has the colomb equal to your username,  if there is then it sets the value of the template owned into $usedid  (Im adding more to that later)

 

The next if statement will be true if $usedid does not equal the template you are trying to buy. Then three actions hapen in the database.  First it will take away your points that you spent.  Next it inserts a row into items2 so in the future if will not let you but the same template twice.  Last it will set you to that template.

 

So look to the bold text above to see where im stuck first...

[DiscoTrio]

*topic magically floats to top*

[DiscoTrio]

hello?

[DiscoTrio]

3rd day, no replies...

[DiscoTrio]

hello....?

[BahBah]

This is not the solution but it may help you debug it.

 

<?php
$con = mysql_connect("localhost","********","**********");
if (!$con) {die('Could not connect: ' . mysql_error());}
mysql_select_db("bmvybfbk_website", $con);
$result = mysql_query("SELECT * FROM templatesearch ORDER BY id");
while($row = mysql_fetch_array($result)) {
    $tid = $row['id'];
    $tprice = $row['price'];
    echo $row['tname'] . "<br>" . $row['preview'] . "<br>" . "Costs: " . $row['price'] . " points.    ";
    echo '<a href="templatesearch.php?action=buy&temp='.intval($tid).'"><font face="Papyrus" size="3">Buy</font></a>';
    echo "<br/><br/>";
    if ($_GET['action'] == 'buy') {
    // You should not trust session data for database queries
    // When storing user login status you should store the userid. You can then easily intval() check it to ensure it's what you were expecting.
    // In addition a userid on a primary key field in your database is less expensive in terms of performance
        $result2 = mysql_query ("SELECT * FROM users WHERE username = '$session->username';");
        while($row = mysql_fetch_array($result2)) {
            $totalpoints = $row['points'];}
        //
        // Uncomment the following 3 lines and try it. The purpose of this is to see if your SQL query is actually returning any data. If $totalpoints and $tprice return a value remove these lines and reply to your post
        // echo "tprice: $tprice<br/>\n";
        // echo "totalpoints: $totalpoints<br/>\n";
        // exit();
        //
        if ($totalpoints >= $tprice) {
            $result2 = mysql_query ("SELECT * FROM items2 WHERE username = '$session->username';");
            while($row = mysql_fetch_array($result2)) {
                $usedid = $row['name2'];
                if ($usedid <> $tid) {
                    mysql_query ("UPDATE users SET points = points - '$tprice' WHERE CONVERT( `users`.`username` USING utf8 ) = '$session->username' LIMIT 1;");
                    mysql_query ("INSERT INTO `items2` (`username`, `name2`, `id2`) VALUES ('$session->username', '$tid', '1');");
                                            mysql_query ("UPDATE users SET tempid = $tid WHERE username = '$session->username' LIMIT 1;");
                    echo"  You bought it!  ";
                    echo '<meta http-equiv="refresh" content="1;url=/$session->username">';
                } else {
                    echo "You already own it!";
                    echo '<meta http-equiv="refresh" content="1;url=templateowned.php">';
                }
            }
        }
    }
}
?>