Need help with Shop on RPG.

[Gregoyle]

For some reason when people Buy Pokeballs it does not subtract the amount of money they have spent, I was wondering if anybody could tell me why

Normally i would get the coder to look into it but hes gone for a week.

 

I know the script is gonna look stupid but thats cause i removed some parts that aren't needed to tell me whats wrong so nobody can just use this.

 

  if(isSet($_POST['submit']) && $_POST['submit'] == 'Buy Pokeballs') {
    $stones = array_filter($_POST['ball']);

    foreach($stones AS $name=>$amount) {
      $doQuery = mysql_query("SELECT * FROM `poke_balls` WHERE `name_caps` = '$name' LIMIT 1");

      if(mysql_num_rows($doQuery)) {
        $result = mysql_fetch_assoc($doQuery);
        if($result['stock'] < $amount) {
          $_SESSION['error'] = 'The shop doesn\'t have that many '.$name.'\'s in stock.';
          header('Location: pokeball_shop.php'); exit;
        } else {
          $uName       = preg_replace('/[^a-z]/','',strtolower($name));
          $userQuery   = mysql_fetch_assoc(mysql_query("SELECT `$uName` FROM `users` WHERE `id` = $user->id LIMIT 1"));
          $totalCost   = $totalCost+($amount*$result['price']);
          $queryShop[] = "UPDATE `poke_balls` SET `stock` = ".($result['stock']-$amount)." WHERE `name`='".$name."'";
          $queryUser[] = '`'.$uName.'` = '.($userQuery[$uName]+$amount).'';
        }

      } else {
        $_SESSION['error'] = 'You cannot buy pokeballs that don\'t exist.';
        header('Location: pokeball_shop.php'); exit;
      }
    }

    if(count($stones) <= 0) {
      $_SESSION['error'] = 'You must select some pokeballs to buy.';
      header('Location: pokeball_shop.php'); exit;
    }

    if($totalCost > $user->gold) {
      $_SESSION['error'] = 'You don\'t have enough gold to complete this purchase.';
      header('Location: pokeball_shop.php'); exit;
    } else {

      foreach($queryShop AS $query) {
        mysql_query($query);
      }
      $newGold = $user->gold - $totalCost;
      $doUserquery = mysql_query("UPDATE `users` SET gold=".$newGold." , ".implode(' , ',$queryUser)." WHERE id = $user->id LIMIT 1");
      
      $_SESSION['success'] = 'You have successfully purchased these pokeballs.';
      header('Location: pokeball_shop.php'); exit;

    }
  }

  include('left_menu.php');

?>
<script type="text/javascript">
<!--
  function addCommas(nStr) {
    nStr += '';
    x = nStr.split('.');
    x1 = x[0];
    x2 = x.length > 1 ? '.' + x[1] : '';
    var rgx = /(\d+)(\d{3})/;
    while (rgx.test(x1)) {
      x1 = x1.replace(rgx, '$1' + ',' + '$2');
    }
    return x1 + x2;
  }

  function updateTotal() {
    var stoneCount  = ((document.getElementById('shopTable').rows.length)-3);
    var totalAmount = 0;
    for(i=1; i<=stoneCount; i++) {
      thisPrice   = document.getElementById('shopTable').rows[i].cells[1].innerHTML.replace(/[^0-9]/g,'');
      thisAmount  = document.getElementById('shopTable').rows[i].cells[3].childNodes[1].value.replace(/[^0-9]/g,'');
      document.getElementById('shopTable').rows[i].cells[3].childNodes[1].value=thisAmount;
      totalAmount = totalAmount+(thisAmount*thisPrice);
    }
    if(totalAmount > <?=$user->gold;?>) {
      document.getElementById('cost').innerHTML='<span style="color:#990000;">$'+addCommas(totalAmount)+'</span>';
    } else {
      document.getElementById('cost').innerHTML='<span style="color:#009900;">$'+addCommas(totalAmount)+'</span>';
    }
  }
//-->
</script>

  
?>


    <form action="pokeball_shop.php" method="POST">
      <table cellpadding="0" cellspacing="1" border="0" style="background:#000; margin: 10px auto;" id="shopTable">
        <tr> 
          <td class="listHead"> Pokeball </td>
          <td class="listHead"> Price </td>
          <td class="listHead"> Stock </td>
          <td class="listHead"> Buy </td>
        </tr>
<?PHP 

  $doQuery = mysql_query("SELECT * FROM `poke_balls` ORDER BY `cost` ASC");

  
        <tr> 
          <td colspan="3" class="totalCost"> Total Cost: </td>
          <td id="cost" class="cost"> $0 </td>
        </tr>
        <tr> 
          <td colspan="4" class="formButton"> <input type="submit" name="submit" value="Buy Pokeballs" class="button" > <input onClick="document.getElementById('cost').innerHTML='$0';" type="reset" value="Clear" class="button" > </td>
        </tr>
      </table>
    </form>

  </div>

<?PHP include ("right_menu.php");?>

[btherl]

This query may be failing:

 

$doUserquery = mysql_query("UPDATE `users` SET gold=".$newGold." , ".implode(' , ',$queryUser)." WHERE id = $user->id LIMIT 1");

 

Try changing it to this:

 

$doUserquery = mysql_query("UPDATE `users` SET gold=".$newGold." , ".implode(' , ',$queryUser)." WHERE id = $user->id LIMIT 1") or die("Query to update user's gold failed:" . mysql_error());

[revraz]

I wonder why people put a LIMIT on their update queries.  If there is more than 1 row that matches the query, how do you know which row is updated?  Plus, if done correctly, there should only be 1 result.

[gizmola]

I wonder why people put a LIMIT on their update queries.  If there is more than 1 row that matches the query, how do you know which row is updated?  Plus, if done correctly, there should only be 1 result.

 

Yeah I agree, it's like they are praying that their logic works, but if it doesn't, well woops, at least i can only f-up one record! Silly stuff.

[gizmola]

This is bad too:

 

$queryShop[] = "UPDATE `poke_balls` SET `stock` = ".($result['stock']-$amount)." WHERE `name`='".$name."'";

 

It should be stock = stock - $amount.  The database takes care of concurrency.

 

Let's say that person A and person B both do these queries around the same time, so they each see that the stock is 5 balls.

 

Person A buys 2 balls.

 

5 balls - 2 balls = 3 balls. 

 

A split second later the 2nd person runs their update.

 

5 balls -1 balls = 4 balls.

 

Now inventory shows 4 balls, even though 3 balls have been delivered.    The database is already atomic and handles concurrency. That's just wrong-headed code.

[btherl]

That sounds pretty good to me gizmola.  Who would want the store to run out of pokeballs?  There's nothing worse than encountering a rare pokemon and finding you've got no pokeballs left

[gizmola]

That sounds pretty good to me gizmola.  Who would want the store to run out of pokeballs?  There's nothing worse than encountering a rare pokemon and finding you've got no pokeballs left

 

They certainly won't be rare, considering the problems with the current code.