Php Problem with mysql_query()

Question

I've been having problems with my php code. I seem to be getting an error from @mysql_query() .

Here's my code for php:

<?php
// A simple PHP script demonstrating how to connect to MySQL.
// Press the 'Run' button on the top to start the web server,
// then click the URL that is emitted to the Output tab of the console.

$servername = getenv('IP');
$username = getenv('C9_USER');
$passwordp = "";
$database = "game_database";
$dbport = 3306;

// Create connection
mysql_connect($servername, $username, $passwordp, $dbport)or die("Cant Connect to server");
mysql_select_db($database) or die("Cant connect to database");
// Check connection


$Email = $_REQUEST["Email"];
$Password= $_REQUEST["Password"];

if (!$Email || !$Password){
echo"Email or password must be used";
}
else{
$SQL = "SELECT * FROM 'users' WHERE Email = '"  . $Email ."'";
$result_id = @mysql_query($SQL) or die("Database Error");
$Total = mysql_num_rows($result_id);
if ($Total){
    $datas = @mysql_fetch_array($result_id);
    if (strcmp($Password, $datas["Password"])){
                $sql2 = "SELECT Characters FROM users WHERE Email = '" . $Email ."'";
                $result_id2 = @mysql_query($sql2) or die("Database Error!!!");
                while ($row = mysql_fetch_array($result_id2)){
                    echo $row ["Characters"];
                    echo ":";
                    echo "Success";
                }
    }
    else{
        echo "WrongPassword";
    }
    }else {
        echo "NameDoesNotExist";
    }
}

?>

Here's my code for C#:

using UnityEngine;
using System.Collections;
using UnityEngine.UI;

public class LoginScript : MonoBehaviour {
#region Variables
//Static Variables
public static string Email = "";
public static string Password = "";
//Private Variables
private string createAccountUrl = "https://credmanager-rowanharley.c9.io/createaccount.php";
private string loginUrl = "https://credmanager-rowanharley.c9.io/loginaccount.php";
private string ConfirmPass= "";

private string CreateEmail = "";
private string CreatePassword = "";
//Public Variables
public string currentMenu = "Login";

//GUI test section
public float X;
public float Y;
public float Width;
public float Height;
#endregion
    // Use this for initialization
    void Start () {

    }

    void OnGUI(){
        //If current menu is = login call login screen
        if (currentMenu == "Login"){
            LoginGUI();
        }
        //If current menu is = Create Account call CreateAccount screen
        else if(currentMenu == "CreateAccount"){
            CreateAccountGUI();
        }
    }
    //This method will login to accounts
    void LoginGUI(){
        GUI.Box (new Rect (210, 15, 300, 300), "Login");
        if (GUI.Button (new Rect (250, 275, 105, 35), "Register Now!!!")) {
            currentMenu = "CreateAccount";
        }
        if (GUI.Button (new Rect (370, 275, 105, 35), "Login!")) {
            StartCoroutine(LoginAccount());
        }
        GUI.Label(new Rect(225, 55, 290, 100), "Before Continuing you need to login or register.");

        GUI.Label(new Rect(215, 102, 100, 100), "Email:");
        Email = GUI.TextField (new Rect (330, 100, 150, 25), Email);

        GUI.Label(new Rect(215, 150, 100, 100), "Password:");
        Password = GUI.TextField (new Rect (330, 147, 150, 25), Password);
    }
    void CreateAccountGUI(){
        GUI.Box (new Rect (210, 15, 300, 300), "Register to save progress");
        if (GUI.Button (new Rect (250, 275, 105, 35), "Back")) {
            currentMenu = "Login";
        }
        GUI.Label(new Rect(225, 55, 290, 100), "Register NOW!!!");

        GUI.Label(new Rect(215, 102, 100, 100), "Email:");
        CreateEmail = GUI.TextField (new Rect (330, 100, 150, 25), CreateEmail);

        GUI.Label(new Rect(215, 150, 100, 100), "Password:");
        CreatePassword = GUI.TextField (new Rect (330, 147, 150, 25), CreatePassword);

        GUI.Label(new Rect(215, 198, 122, 100), "Confirm Password:");
        ConfirmPass = GUI.TextField (new Rect (330, 194, 150, 25), ConfirmPass);



        GUI.Box (new Rect (210, 15, 300, 300), "Register to save progress");
        if (GUI.Button (new Rect (250, 275, 105, 35), "Back")) {
            currentMenu = "Login";
        }
        if (GUI.Button (new Rect (370, 275, 105, 35), "Create Account")) {
            if (CreatePassword == ConfirmPass){
                StartCoroutine("CreateAccount");

            }
            else{
                Debug.Log("Both Passwords are not the same");
            }
        }
    }



    IEnumerator CreateAccount(){
        //this sends info to php form
        WWWForm CreateAccountForm = new WWWForm ();
        CreateAccountForm.AddField ("Email", CreateEmail);
        CreateAccountForm.AddField ("Password", CreatePassword);

        WWW CreateAccountWWW = new WWW (createAccountUrl, CreateAccountForm);
        yield return CreateAccountWWW;

        if (CreateAccountWWW.error != null) {
            Debug.LogError ("Failed to Create Account. Is Internet On? Is URL Correct? Error Message: " + CreateAccountWWW.error);
        } else {
            string CreateAccountReturn = CreateAccountWWW.text;
            Debug.Log("Successfully Created Account " + CreateEmail);
            Application.LoadLevel("MainScene");
        }
    }

    IEnumerator LoginAccount(){
        Debug.Log ("Attempting to login...");
        WWWForm Form = new WWWForm ();
        Form.AddField ("Email", Email);
        Form.AddField ("Password", Password);
        WWW LoginAccountWWW = new WWW (loginUrl, Form);
        yield return LoginAccountWWW;
        if (LoginAccountWWW.error != null) {
            Debug.LogError("Problem with Database. Error Message: " + LoginAccountWWW.error);
        } 
        else {
            string LogText = LoginAccountWWW.text;
            Debug.Log(LogText);
            string[] LogTextSplit = LogText.Split(':');
            if (LogTextSplit[1] == "Success"){
                Application.LoadLevel("MainScene");
            }
        }
    }
}

When I press play from unity editor I get error: "Database Error" from @mysql_query() on $result_id.

Answer 1

use query string as format like this

"SELECT m . name FROM test . members WHERE name =%s OR id =%d OR sex IN (%a)", "Evil 'injection'", 'NaN', array('male', 'female', 'both', 'other', "Alien quote'man"));