What is wrong with my code?

[kilauea]

I can't figure out what I am doing wrong here. I am trying to load variables in based on the user's name. Any help would be greatly appreciated. Here is my code.

First my PHP code:
<?php
$connect = mysql_connect("localhost", "root", "");
mysql_select_db("gamedata", $connect);
$name = trim($name);
$query = mysql_query("SELECT hp, mp, cname FROM gdata WHERE userName = '$name'");
if(mysql_num_rows($query)<1)
{
return "error=not present in database";
}
$row = mysql_fetch_array($query);
return "hp=$row[$hp]&mp=$row[$mp]&cname=&row[cname]");
?>

And this is my actionscript:
var forVars = new LoadVars();
forVars.name = name.text;
forVars.sendAndLoad("char.php", forVars, 'POST');
forVars.onLoad = function()
{
if(this.error != undefined)
{
errorMsg.text = this.error;
submit1.enabled = true;
} else {
var hp = this.hp;
var mp = this.mp;
var cname = this.cname;
}
}

[tg]

i dont know php, but in this line you have a stranded right hand paran with no left hand paran :


return "hp=$row[$hp]&mp=$row[$mp]&cname=&row[cname]");


see... you have a closeing paran with no matching opening paran.
maybe that is your problem

[kilauea]

You are right that should not be there, thanks for noticing that. However, there must be some larger problem with the code since it is still not working.

[MichaelxxOA]

$row = mysql_fetch_array($query);
return "hp=$row[$hp]&mp=$row[$mp]&cname=&row[cname]");


Maybe this should be....


$row = mysql_fetch_assoc($query);
return "hp=$row['hp']&mp=$row['mp']&cname=$row['cname']";


You're fetching an array but treating it like an associative array, ampersand just before row was removed, and I made it treat the fetched value keys as strings, instead of variables.

[MichaelxxOA]

And I guess maybe you should echo that string instead of return it...


echo "hp=$row['hp']&mp=$row['mp']&cname=$row['cname']";


-M

[kilauea]

Thank you for all the help so far. I'm still having problems though.

I'm only trying to get it to display 3 things from my mysql database (hp, mp, and cname) in text boxes in my flash movie. I've revised my PHP and Actionscript and they now look like this:

<?php
$connect = mysql_connect("localhost", "root", "");
mysql_select_db("gamedata", $connect);
$name = trim($name);
$query = mysql_query("SELECT hp, mp, cname FROM gdata WHERE userName = '$name'");
if(mysql_num_rows($query)<1)
{
return "error=not present in database";
}
$row = mysql_fetch_array($query);
echo "hp=$row['hp']&mp=$row['mp']&cname=$row['cname']";

?>

var forVars = new LoadVars();
forVars.name = namebox.text;
forVars.sendAndLoad("char.php", forVars, "POST");
forVars.onLoad = function()
{
if(this.error != undefined)
{
errorMsg.text = this.error;
} else {
hp.text = this.userQuestion;
mp.text = this.mp
cname.text = this.cname
}
}


Thanks in advance for any more help :)

[MichaelxxOA]

Can you tell us what it's doing? Are you getting any errors? Are you getting anything at all? Have you tried printing out the sql statement when you get it just so you can see what the query is being sent as... try tracing the values you get when it returns too.

Do everything you can to validate every line of your code.

[kilauea]

As far as the flash movie, it is doing nothing. I am not sure how to print the sql statement or trace the values.. I'm still pretty newb. Can you help me out?

[MichaelxxOA]

For sure...

Try changing it from sendAndLoad to just send... i think this will open up the page in a new window, it will get your values, and if you have it echoing those values should be there.

I think that'll work so that you can see it, if not we can do it another way.

Peace
-M

[kilauea]

It opened up a new page with nothing displayed on it, completely blank.

[tg]

take our your error handler.
you have an error, and it is hitting the 'return'.

if you take that out. the error should display in your page... at least it does in cf

[tg]

and try echoing your query variable. to see what it contains....


guess it wasnt an error handler, but just an empty query maybe.

[kilauea]

Here is the changes I made, and I'm still just getting blank page:

<?php
$connect = mysql_connect("localhost", "root", "");
mysql_select_db("gamedata", $connect);
$name = trim($name);
$query = mysql_query("SELECT hp, mp, cname FROM gdata WHERE userName = '$name'");
// if(mysql_num_rows($query)<1)
// {
// return "error=not present in database";
// }
$row = mysql_fetch_array($query);
echo "$query"
// echo "hp=$row['hp']&mp=$row['mp']&cname=$row['cname']";

?>

I think I'm echoing the query right?

If I'm having a blank query then I guess it is because I am taking the "$name" out incorrectly somehow. I wonder what I'm doing wrong? Name is a variable in my movie, it is also the name of the text box that the name variable will be in. Perhaps I need to modify my AS too?

Thanks a ton so far guys I'm glad you're all so helpful.

[MichaelxxOA]

<?php
$connect = mysql_connect("localhost", "root", "");
mysql_select_db("gamedata", $connect);
$name = trim($name);
$statement = "SELECT hp, mp, cname FROM gdata WHERE userName = '$name'";
$query = mysql_query( $statement );
// if(mysql_num_rows($query)<1)
// {
// return "error=not present in database";
// }
$row = mysql_fetch_array($query);
echo $statement;
// echo "hp=$row['hp']&mp=$row['mp']&cname=$row['cname']";

?>


idk, try that.

[kilauea]

Doing that gave me a page that says:

SELECT hp, mp, cname FROM gdata WHERE userName = ''

So it would appear that my $name variable is empty. Hmm. What is the correct way to set the $name variable to the contents of a text box in my flash movie then?

[tg]

im sure php has a way to grab either 'Post' variables vs. 'Get' varialbes.... you might want to specifically target the post variable.....

[kilauea]

I'm not sure I'm following you tg.

Also, I set the php to simply retrieve the variables for a name I know exists in the database, in this case "testtest" and it returns nothing. I must be doing something else wrong, too, then?

$connect = mysql_connect("localhost", "root", "");
mysql_select_db("gamedata", $connect);
$name = trim($name);
$statement = "SELECT hp, mp, cname FROM gdata WHERE userName = 'testtest'";
$query = mysql_query( $statement );
// if(mysql_num_rows($query)<1)
// {
// return "error=not present in database";
// }
$row = mysql_fetch_array($query);
// echo $statement;
echo "hp=$row['hp']&mp=$row['mp']&cname=$row['cname']";

?>

If I execute SELECT hp, mp, cname FROM gdata WHERE userName = 'testtest' directly in MySQL it obtains the correct variables.

[MichaelxxOA]

change the following line...


$name = trim( $name );


to...


$name = trim( $_POST[ 'name' ] );


-M

[kilauea]

I just want to thank you all so much for your help. I finally have it. Heres what I ended up with for those interested:

PHP first:
<?php
require_once('conf.inc.php');
require_once('functions.php');


GLOBAL $db,$table;
$uname = trim( $_POST[ 'uname' ] );
$query = mysql_query("SELECT cname, hp, mp from $table WHERE userName = '$uname'");
$row = mysql_fetch_array($query);
echo "cname=$row[cname]&hp=$row[hp]&mp=$row[mp]"
?>

I ended up using a few external config files to make it easier to change things and it is also more secure for later.

The AS:
var cVars = new LoadVars();
cVars.uname = namebox.text;
cVars.action = 'character';
cVars.sendAndLoad('char.php', cVars, 'POST');
cVars.onLoad = function()
{
hp.text = this.hp;
mp.text = this.mp;
cname.text = this.cname;
}

Once again thanks everyone for the help. I'm so glad to finally have this figured out.

[prasoc]

Normally, you add { and } around variables in a string eg
echo "cname={$row['name']}&hp={$row['hp']}";

edit: change "trim($_POST['uname']);" to "trim(mysql_real_escape_string($_POST['uname']));", because hackers could exploit it.

[kilauea]

Thanks for the tips prasoc, but when I change "trim($_POST['uname']);" to "trim(mysql_real_escape_string($_POST['uname']));" the code stops working. When I have it echo the query or the uname variable, I just get a blank white page.

I am worried about this if it is possible for hackers to exploit the way I have it, though.