PHP + MySQL脚本不起作用

Question

I made this script which is giving me a lot of troubles. I'm not so good at MySQL and maybe I'm trying to do stuff too advanced for my knowledge of SQL, but I would really really really like to make this work.

My php script is:

<?PHP
$getusername=$_GET['user'];
$getpassword=$_GET['pass'];
$getworldname=$_GET['worldname'];
$getblock=$_GET['block'];
$getpos=$_GET['pos'];
$user_name = "asdasdasd";
$password = "asdasd";
$database = "asdasd";
$server = "localhost";

$db_handle = mysql_connect($server, $user_name, $password);
$db_found = mysql_select_db($database, $db_handle);


$SQL="SELECT * FROM accounts WHERE username='$getusername' and password='$getpassword'";
$result=mysql_query($SQL);


$count=mysql_num_rows($result);


if($count==1){
    $blockstring=$getpos.'/'.$getblock.'|';
    $SQL="SELECT LOCATE('$getpos', blocks) FROM worlds WHERE name='$getworldname'";
    $result=mysql_query($SQL);
    $count=mysql_num_rows($result);
    echo $count;
    //if there's already that block
    if ($result!=0){
        $posUnknown='|'.$getpos.'/';
        $posKnown='|'.$getpos.'/'.$getblock;
        $SQL="UPDATE worlds SET blocks=replace(blocks,concat('$posUnknown',substring_index(substring_index(blocks, '$posUnknown', 2), '|', 1),'|'),'$posKnown') WHERE name='$getworldname'";
        $result=mysql_query($SQL);
    }else{
        $SQL="UPDATE worlds SET blocks=CONCAT(blocks,'$blockstring') WHERE name='$getworldname'";
        $result=mysql_query($SQL);
    }
    print 'OK';
}else{
    print 'NO';
}
?>

I'm sure I made some mistake, also big ones into the queries, but sadly I can't figure out what I'm doing wrong.

An example of the content of blocks could be:

x10y20z30/0|x999y1231z30/1|x3330y4444z0/99999|etc

What this script does, well, what I wanted it to do is:

• Check username and password, and that works luckily,
• check if the given block already exists in "blocks"
• if it does exist replace the value (the one after the /) of the already existing block with the new one,
• if it doesn't exist just add it to "blocks".

But it doesn't work and I know why. I know it's because of the SQL, but I can't figure out how to make it work.

Answer 1

You have some serious issues with your code's security, as pointed out in a comment. I have done what I can without really changing what your code is doing:

<?PHP
    $getusername=$_GET['user'];
    $getpassword=$_GET['pass'];
    $getworldname=$_GET['worldname'];
    $getblock=$_GET['block'];
    $getpos=$_GET['pos'];
    $user_name = "asdasdasd";
    $password = "asdasd";
    $database = "asdasd";
    $server = "localhost";

You should be using mysqli, not mysql:

    $db = new mysqli($server, $user_name, $password, $database);

All input needs to be escaped before it is used in a query with real_escape_string:

    $SQL="SELECT * FROM accounts WHERE username='" . $db->real_escape_string($getusername) . "' and password='" . $db->real_escape_string($getpassword) . "'";
    $result=$db->query($SQL);

    $count=$result->num_rows;

    if($count==1) {
        $blockstring=$getpos.'/'.$getblock.'|';
        $SQL="SELECT LOCATE('" . $db->real_escape_string($getpos) . "', blocks) FROM worlds WHERE name='" . $db->real_escape_string($getworldname) . "'";
        $result=$db->query($SQL);

        $count=$result->num_rows;
        echo $count;

        //if there's already that block
        if ($count!=0) {
            $posUnknown='|'.$getpos.'/';
            $posKnown='|'.$getpos.'/'.$getblock;

This is probably where you're having trouble, because it looks like you're storing all of this information in a single row:

            $SQL="UPDATE worlds SET blocks=replace(blocks,concat('" . $db->real_escape_string($posUnknown) ."',substring_index(substring_index(blocks, '" . $db->real_escape_string($posUnknown). "', 2), '|', 1),'|'),'" . $db->real_escape_string($posKnown) . "') WHERE name='" . $db->real_escape_string($getworldname). "'";
            $result=$db->query($SQL);
        } else {
            $SQL="UPDATE worlds SET blocks=CONCAT(blocks,'" . $db->real_escape_string($blockstring) ."') WHERE name='" . $db->real_escape_string($getworldname) . "'";
            $result=$db->query($SQL);
        }
        print 'OK';
    } else {
        print 'NO';
    }
?>

Since all of your block information is being shoved together in a single column, your database is not normalized at all and appears to be like this:

Worlds
name    blocks

Your database should probably be structured a lot more like this:

Worlds
id | name
---------------
 1 | demoworld

Blocks
id | WorldID | x     | y    | z  | data
-----------------------------------------
 1 |       1 |    10 |   20 | 30 |     0
 2 |       1 |   999 | 1231 | 30 |     1
 3 |       1 | 33330 | 4444 |  0 | 99999

You can recreate the data layout you provided when you query the data, and when someone tries to add something like x20y30z40/12345, you can parse that to get the x, y, z, and data portions.