Question

I got a point system where i want people to get 1 more point after a input/form. until now i use this code:

<?php
session_start();
//=============Configuring Server and Database=======
$host        =    'localhost';
$user        =    'root';
$password    =    '';
//=============Data Base Information=================
$database    =    'login';

$conn        =    mysql_connect($host,$user,$password) or die('Server Information is not Correct'); //Establish Connection with Server
mysql_select_db($database,$conn) or die('Database Information is not correct');

//===============End Server Configuration============

//=============Starting Registration Script==========


$username    =    mysql_real_escape_string($_POST['txtusername']);

//=============To Encrypt Password===================

//============New Variable of Password is Now with an Encrypted Value========

if(isset($_POST['btnRegister'])) //===When I will Set the Button to 1 or Press Button to register
{
$query = mysql_query("SELECT * FROM quiz WHERE username='$username'");
if(mysql_num_rows($query) > 5 ){
echo "Sorry but you can only take a quize once:S";

}else{

$insert = "UPDATE `users` SET `points` = '".$points."' +1 WHERE `username` = '".$username."'";

 mysql_query($insert); 



mysql_query ("insert into quiz(username)values('$username')");
header('location: succes.php');
}
}
?>

but this code doesnt seem to update/add 1 but insted it replace the number there with 1. so if i have 5 and i run this code it replace with 1 so then it says 1. How can i fix so it add/update? so if one have 3 points and run the code he get 4 points insted off getting repacec:

$insert = "UPDATE `users` SET `points` = '".$points."' +1 WHERE `username` = '".$username."'";

Answer 1

you don’t need to use a variable $points. use the following UPDATE query,

$insert = "UPDATE `users` SET `points` = (`points` + 1) WHERE `username` = '".$username."'";

be warned that the query above is vulnerable with SQL Injection, please read the article below to protect from it,

• How can I prevent SQL injection in PHP?