Take the 2-minute tour ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.

I've recently been working on a fairly complicated game. I've stored information with local storage, but that allows the player to edit it, and does not transfer from computer to computer. The two scripts run on a single server, and I use the following to ping the php server:

function initiateLoginSequence() {
    var isnewplayer=prompt("Hello! Are you new?(Y/N)");
    if(isnewplayer.equalsIgnoreCase("N")) {
        var username = prompt("Enter username.");
        var password = prompt("Enter Password.");
        //parsing code goes here later.
    } else {
        var username = prompt("Enter a username. This will be used for future logins.");
        var password = prompt("Enter a password. This will be used for future logins.","*");
        var req = new XMLHttpRequest();  
        req.open('POST', 'http://69.144.34.106/Scores.php', true);   
        req.send("returning=false"+"&name="+username+"&pw="+password+"&level="+lvl+"&save=true");
        req.send();
    }
}

I then process the results with this:

<?php
   $returning=_POST["returning"];
   $save=_POST["save"]
   $password=_POST["pw"];
   $username=_POST["name"];
   $score=_POST["lvl"];
   $connection=mysql_connect("localhost:3306","****","*****");
   if($returning=="false" && $save=="true") {
     mysql_select_db("userdata",$connection);
     $sqlcmd = "CREATE TABLE ".$username."(
     Username varchar(".$username.")
     Password varchar(".$password.")
     Score varchar(".$score.")
     )";
     mysql_query($sqlcmd);
   } else if($save==false) {
     $sqlcmd="SELECT * FROM userdata"
     $result = mysql_query($sqlcmd);
     while($row=mysql_fetch_array($result)) {
        if($row['Username']==$username && $row['Password']) {
            echo row['Score'];
        }
     }
   } else if($save==true) {
     $sqlcmd="SELECT * FROM userdata"
     $result = mysql_query($sqlcmd);
     while($row=mysql_fetch_array($result)) {
        row['Username']=$username
        row['Password']=$Password
        row['Score']=$Score
     }
   }
?>

But after creating the mysql database, nothing is populated. So my basic question is, Am I doing this right? If not, what am I missing?

share|improve this question
add comment

closed as too localized by bummzack, Sean Middleditch, Byte56, Josh Petrie, Noctrine Feb 12 '13 at 23:28

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

up vote 6 down vote accepted

Several points:

  • You should definitely enable error reporting and error logging into a file on the PHP side, otherwise you'll have no evidence of problems. AJAX errors usually cause little visible error to the user.
  • You should check for errors on the Javascript side too

PHP error handling is famous for being both bad (e.g. the default action for most unusual conditions is to continue regardless and issue a warning, which possibly goes to the client browser, or might be ignored as well), AND complicated. Once you fully understand PHP error handling, you can write an error handler which carries out appropriate actions in all cases.

In my opinion:

  • Creating a table for each user is not a good database model (Consider a row per user instead)
  • Hard-coding the server IP address in the Javascript code is almost certainly not the right thing to do (e.g, how do you move your application from your test to production server without changing it?)
  • a PHP error handler should log all errors and report every possible piece of contexual information (especially a stack trace) into the error log, and stop execution; it is necessary to provide a mechanism for certain errors to be suppressed in some cases (for example, error_reporting). Don't use the @ operator ever.

Security:

  • You may wish to research what SQL injection is, before you continue to use PHP / MySQL in your application (Hint: Consider using parameterised queries)
share|improve this answer
3  
@dylanisawesome1 Definitely research what SQL injections are and how to prevent them. Your current code allows any user to do anything they want to your database, including adding, changing and deleting data of other users. –  Philipp Feb 11 '13 at 13:13
1  
Hard-coding the server IP address in the Javascript code is almost certainly not the right thing to do Actually this isn't necessarily a problem (eg. we do that in the game client I work on) but does involve defining both the dev AND production URLs and then having the server tell the game which environment it is in. So either do that or have the server actually inject the URL when serving up the game; either way, you need to have code on the server that tells the game how to initialize, something like point to init.php and have that generate the page for the game –  jhocking Feb 11 '13 at 14:12
    
It's my opinion - it would be easier for the Javascript code to determine its own server address (i.e. its own server) than to try to distribute the right IP address in each case. Yours might be different. –  MarkR Feb 11 '13 at 17:03
add comment

It seems to me like you have a misconception about what's the meaning of a TABLE and whats the meaning of a DATABASE in SQL.

A database has many tables.

Each table can have multiple columns and entries ("rows").

The SELECT statement gets data from a table of the currently active database. You are trying to select from userdata, which is the name of your database, not from a table of your database.

Your CREATE TABLE command is semanitically wrong. When you create a table, you create the columns. The columns define how each entry in the table looks, but no data is inserted yet. This happens later with separate INSERT INTO commands. The values in parenthesis after varchar is the length of the fields of the column. For example, username VARCHAR(20) means that each entry in the table has a field username which is a variable-length string with a length of up to 20 characters.

Also, you generally create the tables once when you deploy the application. When the application is in use, you avoid adding or changing tables. When you have multiple users, you usually create one table users where each row represents one user. The columns you create in the CREATE TABLE command (which is usually not done with PHP code but with a GUI tool like PhpMyAdmin) describe what data is saved in each row.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.