这个mysql_query只工作几次

Question

I don't know why but this mysql_query is just working some times. i don't know why becasue everything is working fine this one here:

mysql_query("UPDATE users SET `profit`=profit+$profit, `won`=won+$jackpotcost, `gameswon`=gameswon+1, `games`=games+1 WHERE `steamid`='$winnerid'") or die(mysql_error()); 

But this one does not work:

while($row = mysql_fetch_array($rs))
{
    if($row["userid"] == $winnerid)
    {
        $time=time();
        $time=$time+10;
        mysql_query("UPDATE users SET `profit`=profit+$profit, `won`=won+$jackpotcost, `gameswon`=gameswon+1, `games`=games+1 WHERE `steamid`='$winnerid'") or die(mysql_error());
        mysql_query("INSERT INTO `messages` (`type`,`app`,`userid`,`title`,`msg`,`time`,`active`,`delay`) VALUES ('success','0','$winnerid','Congratulations!','You won $$jackpotcost in Game #$cg with a $wonpercent% chance!','10',1,$time)");
    }
    else
    {
        $loserid = $row["userid"];
        $rs = mysql_query("SELECT * FROM ".$p2t."game".$cg." WHERE `userid`=".$loserid."");
        $losercost=0;
        while($lrow = mysql_fetch_array($rs))
        {
            $losercost+=$lrow['value'];

        }
        $time=time();
        $time=$time+10;
        mysql_query("UPDATE users SET `profit`=profit-$losercost, `games`=games+1 WHERE `steamid`='$loserid'") or die(mysql_error());
        mysql_query("INSERT INTO `messages` (`type`,`app`,`userid`,`title`,`msg`,`time`,`active`,`delay`) VALUES ('error','0','$loserid','GL Next Game!','$winnername won $$jackpotcost in Game #$cg with a $wonpercent% chance!','10',1,$time)");

    }
}

If someone can help me and explain what is wrong with it

Answer 1

You're overwriting the $rs variable on the inner loop. Change the name and it should be fine.

Answer 2

If it is working sometimes, I suspect that you are not using mysql_real_escape_string($variable) .

You'll want to do:

$variable = ""; // content goes here

// then for readying the input
mysql_real_escape($variable);
$query = ""; // your query goes here.
mysql_query($query);

What does this do?

---

mysql_real_escape_string() Is going to escape quotes that are entered into the variable or user input. It will ready your varable/input for queries.

NOTE: You might want to move to MySQLi (AKA: MySQL improved ) or move to PDO. It will improve your code majorly with security issues.

Hoped this helped.