Question

I am saving the gamestate from a mobile game on a MySql database. The information is successfully saved, however it is echoing that there was an error in saving the game state. I’m still adjusting to php and not sure where this is coming from.

PS I know the SQL statement is insecure. Right now I’m just getting the fundamentals up and running as the statements and tables themselves will change soon.

Listining for incoming json:

    } else if ($tag == 'save_game_state') {
    $email = $_POST['email'];
    $virtumon = $_POST['monster'];
    $qty = $_POST['qty'];
    $exp = $_POST['exp'];
    $user = $db->saveGameState($email, $monster, $qty, $exp);
        if ($user) {
            $response["success"] = 1;
            $response["The game state has been successfully saved"];
         echo json_encode($response);
        } else {
            // user failed to store
            $response["error"] = 1;
            $response["error_msg"] = "Error occured in saving the game state";
            echo json_encode($response);
        }

Inputting the information into the DB and returning success/failure.

    public function saveGameState($email, $monster, $qty, $exp) {

    $result = mysql_query("INSERT INTO user_profiles(email, monster, qty, exp) VALUES('$email', '$monster', '$qty', '$exp')") or die(mysql_error());
    // TODO check for successful store
    $success = mysql_query("SELECT email, monster, qty, exp FROM user_profiles WHERE email = '$email' AND monster= '$monster' AND qty = '$qty' AND exp = '$exp'");
   if ($success) {
            return mysql_fetch_array($success);
    } else {
       return false;
   }
}

Answer 1

Definitely shouldn’t run a SELECT after your INSERT to check and see if it worked. Just check what $result is after it’s ran. From

From http://php.net/manual/en/function.mysql-query.php :

For other type of SQL statements, INSERT, UPDATE, DELETE, DROP, etc, mysql_query() returns TRUE on success or FALSE on error

Try

$result = mysql_query("INSERT INTO user_profiles(email, monster, qty, exp) VALUES('$email', '$monster', '$qty', '$exp')") or die(mysql_error());
return $result;

If you want to return the contents of what you just inserted then call another function after you run saveGameState. Though, if you already have the values you can just use those instead of querying the database again.

You should also look into the use of PDO.