Simple Php\mysql Issue, Not Increasing Columns.

[doofy]

It's doing everything correctly, other than only allowing Reaction="AWESOME" increase in the mysql db. Any ideas on this, I thought it was straight forward, but it's illuding my eyes and probably right in front of me.

 

Any direction would be appreciated extremely much.

 

<?
error_reporting (E_ALL);
// Db Connection
xxx
// Get the Reaction
$Reaction = mysql_real_escape_string(htmlspecialchars($_GET['Reaction']));
// Get IP
$ip = $_SERVER['REMOTE_ADDR'];
// Append IP to current column
$Used_IPs = '';
$Used_IPs .= $ip . ', ';
// Get previous URL
$Link = $_SERVER['HTTP_REFERER'];
// Check to see if already voted based on IP and reference link
$voted=mysql_num_rows(mysql_query(" SELECT Used_IPs FROM Reactions WHERE Link='$Link' AND Used_IPs LIKE '%".$ip."%' "));
if (empty($voted))
{
// Get current row
$result = mysql_query(" SELECT * FROM Reactions WHERE Link='$Link' ") or die(mysql_error());
$row = mysql_fetch_array($result) or die(mysql_error());

// Update Reaction
if ($Reaction == 'AWESOME')
{
$AWESOME = $row['AWESOME'];
$AWESOME++;
mysql_query(" UPDATE Reactions SET AWESOME='$AWESOME', Used_IPs='$Used_IPs' WHERE Link='$Link' ") or die (mysql_error());
}
if ($Reaction == 'LOL')
{
$LOL = $row['LOL'];
$LOL = $LOL++;
mysql_query(" UPDATE Reactions SET LOL='$LOL', Used_IPs='$Used_IPs' WHERE Link='$Link' ") or die (mysql_error());
}

if ($Reaction == 'CUTE')
{
$CUTE = $row['CUTE'];
$CUTE = $CUTE++;
mysql_query(" UPDATE Reactions SET CUTE='$CUTE', Used_IPs='$Used_IPs' WHERE Link='$Link' ") or die (mysql_error());
}
if ($Reaction == 'WTF')
{
$WTF = $row['WTF'];
$WTF = $WTF++;
mysql_query(" UPDATE Reactions SET WTF='$WTF', Used_IPs='$Used_IPs' WHERE Link='$Link' ") or die (mysql_error());
}
if ($Reaction == 'FAIL')
{
$FAIL = $row['FAIL'];
$FAIL = $FAIL++;
mysql_query(" UPDATE Reactions SET FAIL='$FAIL', Used_IPs='$Used_IPs' WHERE Link='$Link' ") or die (mysql_error());
}
if ($Reaction == 'LAME')
{
$LAME = $row['LAME'];
$LAME = $LAME++;
mysql_query(" UPDATE Reactions SET LAME='$LAME', Used_IPs='$Used_IPs' WHERE Link='$Link' ") or die (mysql_error());
}
}
mysql_close($con);
header("Location: {$_SERVER['HTTP_REFERER']}");
?>

[premiso]

Ok, so first up, try this query instead:

 

mysql_query(" UPDATE Reactions SET AWESOME=AWESOME+1, Used_IPs='$Used_IPs' WHERE Link='$Link' ") or die (mysql_error());

 

This will be way better than fetching each item and incrementing it in PHP and way less code.

 

Second up:

$Reaction = mysql_real_escape_string(htmlspecialchars($_GET['Reaction']));

 

Why are you doing that to reaction and using it for a check? I do not even see you using $_GET['Reaction'] in a query. I can understand the specialchars, but that should only be applied when you are attempting to display reaction, not just whenever or just because.

[doofy]

Thanks for the solution and the advice about escaping\specialchars, I was playing it safe, but upon reflection of your advice, it makes zero sense to validate it as you've mentioned.

 

Cheers,

Chris

[doofy]

I've donated $5 bucks for your time (sorry I'm broke or I'd have given more).

 

Cheers,

Chris

[premiso]

I've donated $5 bucks for your time (sorry I'm broke or I'd have given more).

 

 

You just bought me my goatse domain! I am in your debt

 

Glad to help and thanks for helping with the domain name!

[Philip]

I've donated $5 bucks for your time

Goatse.me domain purchased thanks to doofy

 

DO YOU REALIZE WHAT YOU'VE DONE?

[doofy]

I like starting fires.