Thanks a lot for your help I think I've managed to fix everything you suggested:
1) Sorted the first query out
2) Removed the while loop
3) Checked that $id is a numberic value
4) Checked that the vote is a numeric value
5) Checked that the vote is in the specified range
6) Added the hidden field for the id
I'd heard of using a hidden field before but I thought there was another way that I'd read about somewhere...
here's the new script:
# Check that the id passed is a number
if (is_numeric($id))
{
}
else
{
echo 'Error: That id is not a valid integer';
exit();
}
#Assign the query a variable so that it can be parsed by the custom error handler
$query = "SELECT `score`, `votes` FROM phpbb_content_sms WHERE `id` = $id";
$result = @mysql_query($query, $connection)
or ThrowError("error with query: " . mysql_error() . "\n\nQuery: " . $query);
if (mysql_num_rows($result) < 1)
{
echo 'Error: That entry does not exist';
exit();
}
# Assign a variable to the row
$row = mysql_fetch_array($result);
# If the vote from the form is numberic give the new total score a value, else the appropriate error message
if (is_numeric($vote))
{
$newtotalscore = ($row['score']+$vote);
}
else
{
echo 'Error the vote is not a valid integer';
exit();
}
# Assign the new total number of votes by adding one to the current total
$newtotalvotes = $row['votes']+1;
# Update the database with the new info
$query = "UPDATE phpbb_content_sms SET `score` = '$newtotalscore', `votes` = '$newtotalvotes' WHERE `id` = '$id'";
@mysql_query($query, $connection)
or ThrowError("error with query: " . mysql_error() . "\n\nQuery: " . $query);
# Leave outside curl brackets so that if it's the first vote the new score if establised for the user message
$newscore = ($newtotalscore / $newtotalvotes);
# If the votes is greater than zero assign appropriate user messages otherwise skip so that php does not try to divide by zero
if ($row['votes'] > 0)
{
$originalscore = ($row['score'] / $row['votes']);
if ($originalscore > $newscore)
{
$difference = ($originalscore - $newscore);
$message = ' lowered this entry by '.$difference;
}
elseif ($originalscore < $newscore)
{
$difference = ($newscore - $originalscore);
$message = ' raised this entry by '.$difference;
}
elseif ($originalscore == $newscore)
{
$message = ' helped keep this entry at '.$newscore;
}
}
# If this is the first vote (i.e $row['votes'] is zero) give the user message a value that they have not changed the score
else
{
$message = ' helped keep this entry at '.$newscore;
}
# Echo the user a message for voting
echo 'Thanks for voting '.$userdata['username'].' your vote of '.$vote.$message.' to give it a new score of '.$newscore;
I'd appreicate it greatly if you could have a quick look through to see if there are any other errors.
- Anthony
