Need some help with this code

[corruptcity || skalman]

hi i could really use some help with my code. The problem ive got with it is that with its not adding the amount to the right stat just shows the strength 1

<?php
include_once "globals.php";
$_GET['statid'] = abs((int) $_GET['statid']);
$_GET['stat'] = abs(@intval($_GET['stat']));
$stat=array(
'Strength' => 'strength',
'Agility' => 'agility',
'Guard' => 'guard',
'Labour' => 'labour',
'IQ' => 'IQ',);
$gain = abs(@intval($_GET['amount']));

$strength = abs(@intval($_GET['amount']));
$agility = abs(@intval($_GET['amount']));
$guard = abs(@intval($_GET['amount']));
$labour = abs(@intval($_GET['amount']));
$IQ = abs(@intval($_GET['amount']));

$statid=$db->query("SELECT * FROM implants WHERE statid={$_GET['statid']} and userid=$userid");
if($db->num_rows($statid)==0)
{
print "Invalid stat ID";
$h->endpage();
exit;
}
else
{
$statid=$db->fetch_row($statid);	
}			
if ($_GET['stat'] == strength)
{
print"You use the implant and you gained $gain amount of strength
";
$db->query("UPDATE userstats SET strength={$ir['strength']}+$strength and userid = $userid");
}
elseif ($_GET['stat'] == agility)
{
print"You use the implant and you gained $gain amount of agility
";
$db->query ("UPDATE userstats SET agility={$ir['agility']}+{$agility} and userid = $userid");
} 
elseif ($_GET['stat'] == guard)
{
print"You use the implant and you gained $gain amount of guard
";
$db->query ("UPDATE userstats SET guard={$ir['guard']}+{$guard} and userid = userid");
} 
elseif ($_GET['stat'] == labour)
{
print"You use the implant and you gained $gainamount of labour
";
$db->query ("UPDATE userstats SET labour={$ir['labour']}+{$labour} and userid = $userid");
} 

elseif ($_GET['stat'] == IQ)
{
print"You use the implant and you gained $gain amount of IQ
";
$db->query ("UPDATE userstats SET IQ={$ir['IQ']}+{$IQ} and userid = $userid");
} 
?>

[seanybob]

RE: Need some help with this code

I hope you don't mind, but I rewrote this sucker. My eyes started burning when I looked at the poor torture you were doing to this php code.

I see a couple problems, one being you are abs((int)) a string, and another that several variables have the same basic name (which is confusing).

$_GET['stat'] is a string, correct?

 

<?php
include_once "globals.php";
$statid = abs((int) $_GET['statid']);
$stat = mysql_real_escape_string($_GET['stat']);

$amount = abs(@intval($_GET['amount']));

$statid=$db->query("SELECT * FROM implants WHERE statid=$statid and userid=$userid");
if($db->num_rows($statid)==0)
{
print "Invalid stat ID";
$h->endpage();
exit;
}
else
{
$stid=$db->fetch_row($statid);	
}			

if($stat != 'strength' && $stat != 'agility' && $stat != 'guard' && $stat != 'labour' && $stat != 'IQ')
{
print "Invalid stat";
$h->endpage();
exit;
}

print"You use the implant and you gained $amount amount of $stat
";
$db->query("UPDATE userstats SET $stat=$stat+$amount and userid = {$ir['userid']}");

?>

[corruptcity || skalman]

yeah it is and sorry for the torture but i wrote that when i was l8 at night and i was half asleep and wanted to get it finished b4 i crashed n ty

[corruptcity || skalman]

it just keeps coming up with invalid stat now

[Joshua]

granted i just glanced over it, but it's because he removed the function that defines the stat :P