Some code potentially causing problems....

[nevynev]

Hi there,

 

I have some code for adding "friends" on a website. In testing occassionally there would be strange mix ups like one user removing another from their friends and deleting the other users other friends etc. I think that may have been because I was tampering with mysql at the time but I need peace of mind and to be sure it works correctly now the code is done.

 

The first script is "addfriend.php"

 

<?php 
.....


$myid = $_SESSION[myid];
$id = strip_tags($_GET[id]);

### Profile Info
$getuser= "SELECT friends FROM users WHERE id=$id";
$getuserres = mysql_query($getuser,$conn) or die(mysql_error());
$row=mysql_fetch_array($getuserres);

$friends= $row['friends'];
$friends = unserialize(urldecode($friends));

#### check to see if not already friends
if($friends != '')
{
if(array_key_exists("$myid", $friends) == TRUE) {$alreadyfriends = 1; }
}

###If yes then select current friends list then add friends to it.

if($_GET[y]=='1')
{

$getfriends= "SELECT friends FROM users WHERE id='$myid'";
$getfriendsres = mysql_query($getfriends,$conn) or die(mysql_error());
$row=mysql_fetch_array($getfriendsres);

$viewerfriends= $row['friends'];
$viewerfriends = unserialize(urldecode($viewerfriends));
if(is_array($viewerfriends) == FALSE){$viewerfriends = array();}
$viewerfriends[$id] = 2;		
$viewerfriends = urlencode(serialize($viewerfriends));
$updateviewer = 
	"
	UPDATE 
	users 
	SET 
	friends = '$viewerfriends'
	WHERE 
	id='$myid'
	";
$updateviewerres =  mysql_query($updateviewer) or die(mysql_error());

### UPDATE USERS FRIENDS

$friends[$myid] = 0;
$friends = urlencode(serialize($friends));

$updateuser = 
	"
	UPDATE 
	users 
	SET 
	friends = '$friends'
	WHERE 
	id='$id'
	";
$updateuserres =  mysql_query($updateuser) or die(mysql_error());

if($notify_add_friend != '0')

		{
		###GET FRIENDS DETAILS
		$getfriend= "SELECT username FROM users WHERE id = '$myid'";
		$getfriendres = mysql_query($getfriend,$conn) or die(mysql_error());
		$row2=mysql_fetch_array($getfriendres);	
		$posterusername = stripslashes($row2['username']);			


		}

header("Location: profile.php?id=$id");
}

?>

 

The second is removefriend.php

 

<?php 
....

$myid = $_SESSION[myid];
$id = strip_tags($_GET[id]);


$getuser= "SELECT friends FROM users WHERE id=$id";
$getuserres = mysql_query($getuser,$conn) or die(mysql_error());
$row=mysql_fetch_array($getuserres);

$friends= $row['friends'];
$friends = unserialize(urldecode($friends));


#### check to see if friends
if($friends != '')
{
if(array_key_exists("$myid", $friends) == TRUE) {$alreadyfriends = 1; }
}

###If yes then select current friends list then add friends to it.

if($_GET[y]=='1' AND $alreadyfriends == '1')
{
###REMOVE YOURSELF FROM FRIENDS LIST
$getfriends= "SELECT friends FROM users WHERE id='$id'";
$getfriendsres = mysql_query($getfriends,$conn) or die(mysql_error());
$row=mysql_fetch_array($getfriendsres);

$friendfriends= $row['friends'];
$friendfriends = unserialize(urldecode($friendfriends));
unset($friendfriends[$myid]);

$friendfriends = urlencode(serialize($friendfriends));

$updateuserfriends = 
	"
	UPDATE 
	users 
	SET 
	friends = '$friendfriends'
	WHERE 
	id='$id'
	";
$updateuserfriendsres =  mysql_query($updateuserfriends) or die(mysql_error());

#### REMOVE FRIEND FROM YOUR LIST
$getmyfriends= "SELECT friends FROM users WHERE id='$myid'";
$getmyfriendsres = mysql_query($getmyfriends,$conn) or die(mysql_error());
$row=mysql_fetch_array($getmyfriendsres);

$myfriends= $row['friends'];
$myfriends = unserialize(urldecode($myfriends));
unset($myfriends[$id]);

$myfriends = urlencode(serialize($myfriends));

$updateuser = 
	"
	UPDATE 
	users 
	SET 
	friends = '$myfriends'
	WHERE 
	id='$myid'
	";
$updateuserres =  mysql_query($updateuser) or die(mysql_error());

header("Location: profile.php?id=$id");
}
?>

 

Do these match up? Could any code potentially cause problems like the crossovers etc I mentioned above?

 

Many Many thanks in advance,

NevyNev

[nevynev]

still not working and causing serious problems, driving away customers - help!